Advanced SSH Techniques: Tunnels, Jump Hosts, SSHFS, and Multiplexing

Quick answer: advanced SSH techniques let you do more than log in to a server. You can forward ports, create encrypted tunnels, connect through jump hosts, simplify repeated connections with ~/.ssh/config, mount remote folders with SSHFS, and reuse sessions with multiplexing.

Use these features after you understand the basics and have key based authentication working. If you need the foundation first, start with What Is SSH? A Practical Introduction to Secure Shell and SSH Key Based Authentication.

What Advanced SSH Is Useful For

Advanced SSH is useful when you need to:

• access internal services through a secure server
• connect to private machines through a bastion host
• avoid typing long SSH commands repeatedly
• copy or edit files across machines
• reuse connections for faster repeated commands
• route selected traffic through an encrypted channel

These techniques are powerful, but they can also expose internal services if used carelessly. Treat them as operational tools, not shortcuts around security.

Local Port Forwarding

Local port forwarding opens a port on your local machine and forwards traffic through SSH to a remote destination.

The pattern is:

ssh -L <local-port>:<target-host>:<target-port> user@ssh-server

Example:

ssh -L 8080:localhost:80 user@ssh-server

Now http://localhost:8080 on your machine reaches port 80 from the perspective of ssh-server.

This is useful when:

• a service is only reachable from a remote server
• an admin panel should not be exposed publicly
• you need temporary secure access without changing firewall rules

Remote Port Forwarding

Remote port forwarding does the reverse. It opens a port on the SSH server and forwards traffic back to your local machine or another target.

The pattern is:

ssh -R <remote-port>:<target-host>:<target-port> user@ssh-server

Example:

ssh -R 9000:localhost:3000 user@ssh-server

This lets a process on ssh-server reach your local app through port 9000.

Use this carefully. Remote forwarding can expose local services to a wider network than intended.

Dynamic Port Forwarding

Dynamic port forwarding creates a local SOCKS proxy.

ssh -D 1080 user@ssh-server

Applications that support SOCKS proxies can then route traffic through localhost:1080.

This is useful for testing access from another network path or routing selected browser traffic through an encrypted SSH connection.

Jump Hosts and Bastion Servers

In many environments, private servers are not reachable directly. You connect through a jump host or bastion server first.

The modern command is:

ssh -J user@bastion-host user@internal-server

This connects to the internal server through the bastion in one step.

For repeated use, put it in ~/.ssh/config:

Host bastion
    HostName 198.51.100.10
    User jumpuser
    IdentityFile ~/.ssh/id_ed25519

Host internal
    HostName 10.0.0.5
    User admin
    ProxyJump bastion
    IdentityFile ~/.ssh/id_ed25519

Then connect with:

ssh internal

This is easier to remember and less error-prone than long commands.

SSH Config Aliases

The ~/.ssh/config file is one of the most useful SSH productivity tools.

Example:

Host prod-web
    HostName 203.0.113.10
    User deploy
    Port 22
    IdentityFile ~/.ssh/prod_ed25519

Now this:

ssh prod-web

replaces this:

ssh -i ~/.ssh/prod_ed25519 -p 22 deploy@203.0.113.10

Config aliases reduce mistakes and make scripts easier to read.

SSH Multiplexing

SSH multiplexing reuses an existing SSH connection instead of creating a new handshake each time.

Add this to ~/.ssh/config:

Host *
    ControlMaster auto
    ControlPath ~/.ssh/sockets/%r@%h:%p
    ControlPersist 5m

Create the socket directory:

mkdir -p ~/.ssh/sockets

This can speed up repeated SSH, scp, or rsync commands to the same server.

SSHFS for Remote Files

SSHFS lets you mount a remote directory locally over SSH.

Install it on Ubuntu or Debian:

sudo apt-get update
sudo apt-get install sshfs

Mount a remote folder:

mkdir ~/remote_mount
sshfs user@remote-server:/path/to/folder ~/remote_mount

Unmount when finished:

fusermount -u ~/remote_mount

SSHFS is useful for quick remote file access, but for production workflows I still prefer explicit deployment, rsync, Git, or CI/CD where possible.

Security Checks Before Using Tunnels

Before using SSH forwarding in a real environment, check:

• who can connect to the local or remote forwarded port
• whether the target service assumes it is private
• whether the tunnel should be temporary
• whether logs will show the access path clearly
• whether a firewall or VPN would be a better long-term solution

SSH tunnels are excellent temporary tools. They should not become invisible production architecture without review.

Final Takeaway

Advanced SSH techniques make remote work much more flexible.

Use port forwarding for secure access, jump hosts for private networks, config aliases for repeatable commands, SSHFS for temporary remote file access, and multiplexing for faster repeated sessions.

The more powerful the SSH feature, the more important the guardrails become. Keep keys protected, limit access, document unusual tunnels, and review any setup that exposes internal services.

• ← Previous Post
• Next Post →