that's the simple scenario: from pc A i open a tunnel SSH to a pc B. Can someone, on pc B, use this tunnel to enter or forwarding some protocol to pc A? Can i limit traffic to be generated only from pc A? Thanks.
1 Answer
I'm assuming you're talking about an SSH port-forward "tunnel" -- If you run (for example) ssh -L 8080:B:80 user@B
on host A and haven't done anything funky to your SSH configuration the answer is that there is no risk of "backwash" from host B.
The command above opens a listener on host A's local loopback address (127.0.0.1 / ::1) on port 8080.
When you send traffic to to that listener it is sent over the SSH connection to the other side to Host B port 80.
Replies from host B will travel back along the tunnel, but host B cannot initiate new connections back to host A -- it is a single port forward, not a wide-open tunnel.
Regarding the second part of your question (limiting traffic), by default SSH binds forwarded ports to localhost, so if you use the command above host A is the only one that can use the connection. The full syntax for the -L
option is -L LocalIP:LocalPort:RemoteHost:RemotePort
, however the LocalIP part is typically omitted and defaults to localhost.
For more information consult the OpenSSH man pages.
-
Yes, it's a port-forward tunnel and i use the -L option. Thanks for answer.– JohnSep 9, 2011 at 15:01