假設現在有兩臺伺服器client1，client2，他們直接不能直接相互通訊，但是他們均能連線上第三臺伺服器balance，我們可以在client1，client2和balance三臺機器之間建立ssh隧道來讓client1和client2實現通訊。

ssh埠轉發有三種實現方式：本地轉發，遠端轉發，和動態轉發。

一. 準備工作

實現目標: guangzhou能訪問balance但不能直接訪問new2，balance可以訪問new2；guangzhou通過balance做埠轉發可以間接訪問new2。

1.1 伺服器IP：

伺服器guangzhou: 106.55.241.99

伺服器new2: 106.55.171.53

伺服器balance：124.156.143.168

1.2 伺服器間通訊

伺服器guangzhou：

#可訪問new2
[root@guangzhou ~]# telnet 106.55.171.53 22
Trying 106.55.171.53...
Connected to 106.55.171.53.
Escape character is '^]'.
SSH-2.0-OpenSSH_7.4

#可訪問balance
[root@guangzhou ~]# telnet 124.156.143.168 22
Trying 124.156.143.168...
Connected to 124.156
 
.143.168.
Escape character is '^]'.
SSH-2.0-OpenSSH_7.4

伺服器balance：

#可訪問new2
[root@Balance ~]# telnet 106.55.241.99 22
Trying 106.55.241.99...
Connected to 106.55.241.99.
Escape character is '^]'.
SSH-2.0-OpenSSH_7.4

現在上new2防火牆新增禁止guangzhou訪問並重啟firewalld服務：

[root@new2 ~]# firewall-cmd --permanent --add-rich-rule='
 
rule family=ipv4 source address="106.55.241.99" drop'
success
[root@new2 ~]# firewall-cmd --reload
success

登陸guangzhou伺服器執行命令: telnet 106.55.171.53 22，結果無響應，說明防火牆禁止訪問設定成功。

目前guangzhou無法直連new2，可連線balance，balance可連線new2.

二. 配置埠轉發

2.1 本地轉發

命令：-L localport:remotehost:remotehostport sshserver

說明：localport　　　　　　 本機開啟的埠號

remotehost　　　　　　最終連線機器的IP地址

remotehostport 轉發機器的埠號

sshserver　　　　　　 轉發機器的IP地址

# -L guangzhou-Server-Ip:new2-Server-Ip:new2-Server-Port balance-Server-User@balance-Server-Ip
[root@guangzhou ~]# ssh -L 9001:106.55.171.53:22 root@124.156.143.168
root@124.156.143.168's password:
Last failed login: Thu Oct  8 19:29:00 CST 2020 from 61.135.223.109 on ssh:notty
There were 8 failed login attempts since the last successful login.
Last login: Thu Oct  8 19:26:38 2020 from 106.55.241.99
[root@Balance ~]#

新開視窗開啟guangzhou伺服器：

[root@guangzhou ~]# ssh -p 9001 root@127.0.0.1
The authenticity of host '[127.0.0.1]:9001 ([127.0.0.1]:9001)' can't be established.
ECDSA key fingerprint is SHA256:huOuuKbfM9TN6+rpCMjB2Hk0HI4GSF1WCj7gIVyu48I.
ECDSA key fingerprint is MD5:0f:55:88:04:62:82:fc:8b:6a:f5:9e:5c:56:e1:0b:cc.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[127.0.0.1]:9001' (ECDSA) to the list of known hosts.
root@127.0.0.1's password:
Last failed login: Thu Oct  8 19:29:28 CST 2020 from 213.154.70.102 on ssh:notty
There were 832 failed login attempts since the last successful login.
Last login: Thu Oct  8 18:41:46 2020 from 106.55.241.99
[root@new2 ~]#

上面可見後面新開視窗通過訪問9001埠可以連線上new2伺服器。

2.2 遠端轉發

命令：-R sshserverport:remotehost:remotehostport sshserver

說明：sshserverport 被轉發機器開啟的埠號

remotehost　　最終連線機器的IP地址

remotehostport 被轉發機器的埠號

sshserver 被轉發機器的IP地址

#balance伺服器上開啟埠轉發服務
# -R guangzhou-Server-Port:new2-Server-Ip:new2-Server-Port -fN guangzhou-Server-Ip
[root@Balance ~]# ssh -R 9100:106.55.171.53:22  -fN 106.55.241.99
root@106.55.241.99's password:
[root@Balance ~]#

#guangzhou伺服器上檢視balance埠轉發開啟的9100埠
[root@guangzhou ~]# ss -ntl
State      Recv-Q Send-Q                    Local Address:Port                                   Peer Address:Port
LISTEN     0      128                                   *:27017                                             *:*
LISTEN     0      511                                   *:6379                                              *:*
LISTEN     0      128                                   *:9100                                              *:*
LISTEN     0      128                                   *:111                                               *:*
LISTEN     0      128                                   *:4369                                              *:*
LISTEN     0      128                                   *:22                                                *:*
LISTEN     0      80                                   :::3306                                             :::*
LISTEN     0      511                                  :::6379                                             :::*
LISTEN     0      128                                  :::111                                              :::*
LISTEN     0      128                                  :::4369                                             :::*
#連線9100埠，確認可以連線上new2伺服器
[root@guangzhou ~]# ssh -p 9100 root@127.0.0.1
The authenticity of host '[127.0.0.1]:9100 ([127.0.0.1]:9100)' can't be established.
ECDSA key fingerprint is SHA256:huOuuKbfM9TN6+rpCMjB2Hk0HI4GSF1WCj7gIVyu48I.
ECDSA key fingerprint is MD5:0f:55:88:04:62:82:fc:8b:6a:f5:9e:5c:56:e1:0b:cc.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[127.0.0.1]:9100' (ECDSA) to the list of known hosts.
root@127.0.0.1's password:
Last failed login: Fri Oct  9 11:28:02 CST 2020 from 61.7.235.211 on ssh:notty
There were 3 failed login attempts since the last successful login.
Last login: Fri Oct  9 11:26:16 2020 from 117.136.79.20
[root@new2 ~]#

遠端轉發就是做了一層請求代理服務，將指定客戶端IP和客戶端埠的請求轉發到指定第三方伺服器IP和埠。

2.3動態轉發
命令：-D localhost:localport -fN sshserver

#guangzhou伺服器上關掉所有ssh連線
[root@guangzhou ~]# killall ssh
[root@guangzhou ~]# ssh -D 9200 -fN 124.156.143.168
root@124.156.143.168's password:
[root@guangzhou ~]# curl --socks5 127.0.0.1:9200 http://106.55.171.53
hello~

以上通過設定guangzhou伺服器9200埠轉發已經可以正常請求new2伺服器上的web服務