Chapter 8 Tunneling

Tunneling is a way to forward otherwise unsecured TCP traffic through Secure Shell in encrypted format. Tunneling can provide secure application connectivity, for example, to POP3-, SMTP-, and HTTP-based applications that would otherwise be unsecured.

The Secure Shell v2 connection protocol provides channels that can be used for a wide range of purposes. All of these channels are multiplexed into a single encrypted tunnel and can be used for tunneling (forwarding) arbitrary TCP/IP ports and X11 connections.

The client-server applications using the tunnel will carry out their own authentication procedures, the same way they would without the encrypted tunnel.

The protocol/application might only be able to connect to a fixed port number (e.g. IMAP 143). Otherwise any available port can be chosen for tunneling. For remote (incoming) tunnels, the ports under 1024 (the well-known service ports) are not allowed for the regular users, but are available only for system administrators (root privileges).

There are two basic kinds of tunnels: local (outgoing) and remote (incoming). X11 forwarding and agent forwarding are special cases of a remote tunnel.

Tectia Client provides basic tunneling functionalities..

This chapter gives an example of the Tectia Server settings for a transparent TCP tunneling case and describes the different tunneling options available together with Tectia Client.