Last modified on February 1, 2023
Port forwarding is enabled for your organization in the Admin UI’s security settings. Port forwarding is disabled by default and can only be enabled by users of your organization who have the Account Administrator permission level.
How to Enable Port Forwarding
- In the Admin UI, go to Settings > Security.
- In the Port Forwarding section, under Allow port forwarding through SSH?, select Yes.
- Click activate for all servers.
- When setting up any given Server, check the Allow Port Forwarding box at the bottom of the Server configuration page. Once enabled, SSH connections proxied by StrongDM for this Server will accept local forwarding requests.
Local Forwarding Tutorial
With the Allow Port Forwarding option enabled for a server, your
sdm executable will accept the same local forwarding (
-L) flag that you would normally use with SSH.
In the following example, you will establish a connection and start listening on a forwarded port to send data back and forth. Working through this example requires terminal access and some command-line knowledge.
Outline of the command structure:
sdm ssh [Server Name] -L [Local Port to Forward]:[Target Bind Address]:[Target Port]
Identify the name of your server and which port it is running on; save this for the next step.
local_client:~$ sdm status SERVER STATUS PORT TYPE TAGS port-forwarding-demo connected 25745 ssh
Establish an SSH connection and forward port 3003 on the client machine to port 4003 on the target server (referred to as localhost in this command because this is internal to the target server). Run the following example on your local terminal. You should see the welcome screen for your remote server if everything was successful.
local_client:~$ sdm ssh "port-forwarding-demo" -L 3003:localhost:4003
channel 3: open failed: administratively prohibited: port forwarding is disabled for this server.
Next, we will use Netcat to listen on port 4003 on the target server. Run the following example on your remote server.
remote_server:~$ nc -lv 4003 Listening on [0.0.0.0] (family 0, port 4003)
On your client machine, open up a new terminal window or tab, and connect to your local port 3003 with the following command. You should receive a “connection successful” prompt on the remote server. This shows that the tunnel is working! Try typing
hello-from-client, to send text from client to server over the SSH tunnel:
local_client:~$ nc -v localhost 3003 Connection to localhost port 3003 [tcp/pxc-splr-ft] succeeded! hello-from-client
If all went well, you should have received the messages from your local client on your remote server. At this point, you can also send data back to the client.
remote_server:~$ nc -lv 4003 Listening on [0.0.0.0] (family 0, port 4003) Connection from [127.0.0.1] port 3003 [tcp/*] accepted (family 2, sport 48742) hello-from-client greetings from the server
That concludes this brief tutorial on how to use port forwarding with the StrongDM executable. This method should work with any applications running on non-privileged ports (ports higher than 1024).
Direct with SSH
With this syntax, we will call SSH directly and connect to the port mapped to the server.
local_client:~$ ssh -L 4003:localhost:4003 localhost -p 25745
Alias with SSH
Here we will first create an alias: mapping
sdm. This alias gives us the ability to use the logical name in StrongDM rather than the mapped port.
local_client:~$ alias ssh="/usr/local/bin/sdm ssh wrapped-run"
Connect with the logical name:
local_client:~$ ssh -L 4003:localhost:4003 "port-forwarding-demo"
If any errors occur, please copy them into an email and send them to firstname.lastname@example.org.