[SOLVED] How does SSH dynamic forward (-D) function under the hood?

Issue

How does SSH dynamic forward (-D) function under the hood?

I understand that SSH dynamic forward opens a SOCSK4 proxy on the local host, and that each connection to the SOCK4 proxy is forwarded over the SSH tunnel to the remote destination.

Does SSH intercept the connections to the SOCKS4 proxy? I mean, it cannot be a "normal" SOCKS4 proxy, because then it would directly proxy the connections to the remote hosts.

Furthermore, how does SSH handle responses from the remote hosts, i.e., how does it transfer them back over the SSH tunnel to the recipients on the local host?

Solution

When the -D flag is given, the SSH client will start a built-in SOCKS4/5 proxy. (note: "SOCKS", not "SOCK").

-D [bind_address:]port

Specifies a local “dynamic” application-level port forwarding. This works by allocating a socket to listen to port on the local side, optionally bound to the specified bind_address. Whenever a connection is made to this port, the connection is forwarded over the secure channel, and the application protocol is then used to determine where to connect to from the remote machine. Currently the SOCKS4 and SOCKS5 protocols are supported, and ssh will act as a SOCKS server.

When another application wishes to connect to a proxied service, they will establish a connection via this SOCKS server. The SOCKS protocol is a little bit of negotiation that occurs at the beginning of a connection, something like this: (inspired by the wiki page)

1. ssh -D 1234 user@remote is execute, the SSH client starts a SOCKS proxy server listening on port 1234.
2. A local application wishes to communicate with a service via the SOCKS proxy, so connects to port 1234.
3. The SOCKS client asks for a connection to a particular IP address and port - e.g: 66.102.7.99, port 4321.
4. The SOCKS server, in this case the SSH client, will negotiate to establish this onward connection with it's server (remote, from above). This may fail.
5. The SOCKS server will respond to the client with success / failure information.
6. If successful, all data passed through this socket will now be forwarded appropriately:
   • From the local application, to the SSH server (remote), and then onto 66.102.7.99.
   • From 66.102.7.99 to the SSH server (remote), and then onto the local SSH client, and ultimately the local application.

---

Does SSH intercept the connections to the SOCK4 proxy?

No, the SSH Client is the SOCKS proxy.

I mean, it cannot be a "normal" SOCK4 proxy, because then it would directly proxy the connections to the remote hosts.

I suppose it's not really - the SSH Client and Server act together to achieve the function of a "normal" SOCKS proxy. The high-level result is that the proxy listens on one host, but forwards data from another host, with a magical link in between.

Furthermore, how does SSH handle responses from the remote hosts, i.e., how does it transfer them back over the SSH tunnel to the recipients on the local host?

TCP is a connection-oriented method of communication. That is to say that once a connection is established, data can flow in both directions, and is reliably identified as "related to that connection". With this information it is trivial to associate the data with arbitrary rules such as "forward to the SSH server, who will forward to 66.102.7.99".

Answered By - Attie

Answer Checked By - Katrina (WPSolving Volunteer)