On-demand SSH tunnels with systemd
My homelab includes a small VPS hosted on the internet; let's call it myserver.example.com . It provides me with a static IP address and it mainly runs an application that gathers data for me. For security reasons, the only open port is the SSH one (22) with the password disabled, I can only access with an RSA certificate stored in my ./ssh directory. The application running there has a control…
This article explains how to create on-demand SSH tunnels with systemd, enabling secure remote access to a specific application's control panel without exposing it to the internet. The author describes their homelab setup, consisting of a VPS with static IP address, a gateway on the home LAN, and various devices connected to the LAN. Their goal is to access the application's control panel on port 8080 from any device on the LAN, without opening an HTTP port or maintaining manual SSH connections.
The article outlines two main ideas:
1. SSH local port forwarding, which establishes a secure tunnel between the local machine and the remote server, allowing the remote application's port to be accessed as if it were local. This is achieved using the command `ssh -L A:host:B server`, where `A` is the local port, `host` is the server's IP address, and `B` is the remote application's port.
2. systemd socket activation, which enables on-demand SSH tunnel creation and teardown based on demand. This is accomplished by creating a systemd socket configuration that listens for incoming connections on a local port (e.g., 58080) and automatically establishes the SSH tunnel when a connection is requested.
The author stresses the importance of checking the SSH server's configuration to ensure that TCP forwarding is enabled and explicitly allowed. This can be verified by examining the SSH daemon's configuration file (`sshd -T | grep -i allowtcpforwarding|permitopen`) and, if necessary, adjusting the settings in `/etc/ssh/sshd_config` or a corresponding file under `sshd_config.d/`. After updating the configuration, reload the SSH service using `sudo systemctl reload ssh` or `sudo systemctl reload sshd`.
Once the SSH forwarding and systemd socket activation are configured correctly, the on-demand tunnel can be created by running a single command: `ssh -N -L 58080:localhost:8080 myserver.example.com`. This command establishes an SSH connection to the remote server, forwarding local port 58080 to the remote server's port 8080. When a device on the local network accesses http://192.168.1.104:58080 in a web browser, the request is routed through the established SSH tunnel and delivered to the remote application's control panel at http://myserver.example.com:8080.
The systemd socket automatically manages the SSH tunnel, creating it when needed and closing it after a specified timeout (e.g., 10 minutes), thus eliminating the need for manual management.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
