# Port Redirection and Tunneling

## SSH Tunneling

### Local Port Forwarding

```
ssh -L <local-port-to-listen>:<remote-host>:<remote-port> remote-host
```

### Remote Port Forwarding

```
ssh -R <remote-port-to-listen>:<local-host>:<local-port> remote-host
```

### Dynamic Port Forwarding

```
ssh -D <local-port-to-listen> <remote-host>
```

This command creates a SOCKS proxy listening at \<local-port>. It is required to configure the browser to point to the SOCKS proxy at \<local-port> to redirect all traffics to \<remote-host>.

## Proxychains

Change proxy value to desired proxy server.

{% code title="/etc/proxychains.conf" %}
```
# add proxy here ...
# meanwile
# defaults set to "tor"
socks4 	127.0.0.1 9050
```
{% endcode %}

#### Usage

```bash
proxychains nmap -Pn -sT -sV -p 445,446 $TARGET_IP
```

#### Metasploit Usage

1. Add route to a destined subnet through a session
2. Run socks4a server to listen traffics from proxychains

```bash
msf > route add 172.16.85.0 255.255.255.0 2
msf > use auxiliary/server/socks4a
```

## References

* [https://chamibuddhika.wordpress.com/2012/03/21/ssh-tunnelling-explained/](https://chamibuddhika.wordpress.com/2012/03/21/ssh-tunnelling-explained/)
