SSH Forwarding Patterns — Banks Field Notes

This is the concise command reference for SSH Forwarding Through a Jump Host. Use the longer write-up when choosing between -L, -D, and -J; use the patterns below once the route and final SSH host are known.

The host at the end of the ssh command is the machine that connects to the service named in -L or handles destinations received by -D.

One hop:  Laptop -> jump host -> service
Two hops: Laptop -> jump host -> Kali -> service

One hop: use the jump host directly

Open a shell on the jump host:

ssh '<JUMP_USER>@<JUMP_HOST>'

Forward one service that the jump host can reach:

ssh -N \
  -o ExitOnForwardFailure=yes \
  -L '127.0.0.1:8443:<INTERNAL_HOST>:443' \
  '<JUMP_USER>@<JUMP_HOST>'

Create a SOCKS proxy whose connections leave from the jump host:

ssh -N \
  -o ExitOnForwardFailure=yes \
  -D 127.0.0.1:1080 \
  '<JUMP_USER>@<JUMP_HOST>'

Two hops: reach Kali through the jump host

Open a shell on Kali:

ssh -J '<JUMP_USER>@<JUMP_HOST>' '<KALI_USER>@<KALI_HOST>'

Create a SOCKS proxy whose connections leave from Kali:

ssh -N \
  -o ExitOnForwardFailure=yes \
  -D 127.0.0.1:9090 \
  -J '<JUMP_USER>@<JUMP_HOST>' \
  '<KALI_USER>@<KALI_HOST>'

Forward one service that Kali can reach:

ssh -N \
  -o ExitOnForwardFailure=yes \
  -L '127.0.0.1:8443:<INTERNAL_HOST>:443' \
  -J '<JUMP_USER>@<JUMP_HOST>' \
  '<KALI_USER>@<KALI_HOST>'

Reach Nessus from a Mac

If Nessus runs directly on a VPS or jump box:

ssh -N \
  -o ExitOnForwardFailure=yes \
  -L 127.0.0.1:4350:127.0.0.1:8834 \
  '<VPS_USER>@<VPS_HOST>'

If Nessus runs on Kali or another host reached through a jump box:

ssh -N \
  -o ExitOnForwardFailure=yes \
  -L 127.0.0.1:4350:127.0.0.1:8834 \
  -J '<JUMP_USER>@<JUMP_HOST>' \
  '<NESSUS_USER>@<NESSUS_HOST>'

Open https://127.0.0.1:4350/ on the Mac. The second 127.0.0.1 always refers to the host at the end of the SSH command, so that host must be running Nessus.

RDP to a Windows test machine

If Kali can reach the Windows host on TCP 3389, forward RDP in one command:

ssh -N \
  -o ExitOnForwardFailure=yes \
  -L '127.0.0.1:3390:<WINDOWS_HOST>:3389' \
  -J '<JUMP_USER>@<JUMP_HOST>' \
  '<KALI_USER>@<KALI_HOST>'

On macOS, open Windows App, add a PC, and use 127.0.0.1:3390 as the PC name. Microsoft Remote Desktop was replaced by Windows App on macOS. On a Windows operator machine, use the built-in client:

mstsc.exe /v:127.0.0.1:3390

Use the Windows test machine’s credentials. The Windows host must support incoming RDP, have Remote Desktop enabled, permit the account, and allow TCP 3389 from Kali. Windows Home cannot act as an RDP host.

SSH local forwarding carries TCP only. RDP can also use UDP 3389 for performance, but this route does not forward that UDP transport; the session uses TCP and may perform differently from a direct connection.

Copy a file from Kali

scp -J '<JUMP_USER>@<JUMP_HOST>' \
  '<KALI_USER>@<KALI_HOST>:<REMOTE_FILE>' \
  '<LOCAL_DESTINATION>'

Troubleshoot

Add -vvv to the same SSH command. Check laptop-to-jump authentication, jump-to-Kali reachability, the final host’s route to the service, and whether the chosen local port is already in use.