How can SSH tunnels bypass a firewall?

SSH can carry other traffic inside its encrypted connection, so anyone allowed to make one outbound SSH connection can tunnel almost anything through it. A port forward makes an internal service reachable from outside, or an outside service reachable from inside, without any firewall rule changing; a dynamic forward turns the SSH connection into a proxy for all of a user's traffic. Attackers use this to keep remote access and to move data out quietly. Reduce the risk: allow outbound SSH only from the hosts that need it and only to known destinations, disable forwarding on your SSH servers where it is not needed, and treat a long-lived SSH session from a workstation to an unknown internet address as suspicious. A network sensor cannot see inside the tunnel, but it sees the tunnel: NetSenX flags long-lived or regular connections to outside hosts as beaconing and large transfers as unusual outbound volume, on every plan.

← All 40 questions on Remote work and exposed servicesAll topics