A remote (incoming) tunnel it forwards traffic coming to a remote port to a specified local port.

Setting up remote tunneling allocates a listener port on the remote server. Whenever a connection is made to this listener, the connection is tunneled over Secure Shell to the local client and another connection is made from the client to a specified host and port. The connection from the client onwards will not be secure, it is a normal TCP connection.

For example, if you issue the following command, all traffic which comes to port 1234 on the server will be forwarded to port 23 on the client. See Figure 8.3.

$ sshg3 -R 1234:localhost:23 username@sshserver

The forwarding address in the command is resolved at the (local) end point of the tunnel. In this case localhost refers to the client host.

Figure 8.3. Remote (incoming) tunnel

Tunnels can also be defined for connection profiles in the Connection Broker configuration file. The defined tunnels are opened automatically when a connection with the profile is made. The following is an example from a ssh-broker-config.xml file:

<profile id="id1" host="tower.example.com">
...
  <tunnels>
    <remote-tunnel type="tcp"
                   listen-port="11000"
                   dst-host="localhost"
                   dst-port="99" />
  ...
  </tunnels>
</profile>

When using SSH Tectia Client with the Windows GUI, the tunneling settings can be made under Profile Settings → Tunneling. See Defining Tunneling.