# How can SSH tunnels bypass a firewall?

SSH can carry other traffic inside its encrypted connection, so anyone allowed to make one outbound SSH connection can tunnel almost anything through it. A port forward makes an internal service reachable from outside, or an outside service reachable from inside, without any firewall rule changing; a dynamic forward turns the SSH connection into a proxy for all of a user's traffic. Attackers use this to keep remote access and to move data out quietly. Reduce the risk: allow outbound SSH only from the hosts that need it and only to known destinations, disable forwarding on your SSH servers where it is not needed, and treat a long-lived SSH session from a workstation to an unknown internet address as suspicious. A network sensor cannot see inside the tunnel, but it sees the tunnel: NetSenX flags long-lived or regular connections to outside hosts as beaconing and large transfers as unusual outbound volume, on every plan.

FAQ: [Remote work and exposed services](https://netsenx.com/en/faq/remote) · https://netsenx.com/en/faq/how-can-ssh-tunnels-bypass-a-firewall

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/encrypted-traffic-analysis

## Related questions

- [Is it safe to use SSH over public Wi-Fi?](https://netsenx.com/en/faq/is-ssh-over-public-wifi-safe)
- [How dangerous is port forwarding to a server in the office?](https://netsenx.com/en/faq/how-dangerous-is-port-forwarding-for-an-office-server)
- [How do I check what our company exposes to the internet?](https://netsenx.com/en/faq/how-to-check-what-our-company-exposes-to-the-internet)
- [Is automatic port opening (UPnP) on the office router a risk?](https://netsenx.com/en/faq/is-upnp-on-the-office-router-a-risk)
- [Who notices a remote login at 3 a.m. on a Sunday?](https://netsenx.com/en/faq/who-notices-a-remote-login-at-3-am-on-a-sunday)