domain-map

00 — Domain map

Learning objectives

Sketch A / B / C and place -L, -R, -D on the diagram.
Name the HTB teaching stack (Academy first; Vault / Poison / home lab) and the peachcyber handout.

Intuition

SSH can carry other TCP for you: pull one port to your laptop (-L), push one of your ports to the bastion (-R), or open a SOCKS door through the bastion (-D).

Friend annotation — where you type vs who listens

Usual class topology: you already SSH to B. You type both -L and -R on A (your laptop). The flag does not mean "run -R on the target."

You said	Precise meaning
`-L` opens my `8080` for whatever is on their `80`	Yes. Listener on A:`8080`. Browser hits `127.0.0.1:8080` on A → B dials `C:80` (or `127.0.0.1:80` on B).
`-R` opens `8080` on the target back to my `8080`	Yes, with port names clear: listener on B (often `127.0.0.1:18080`). Something on B hits that port → A serves your `127.0.0.1:8080`.

# both from YOUR laptop (A)
ssh -N -L 127.0.0.1:8080:127.0.0.1:80 user@B   # pull their :80 to your :8080
ssh -N -R 127.0.0.1:18080:127.0.0.1:8080 user@B # push your :8080 onto B as :18080

Only if B opens SSH back to you (you are the SSH server) do the roles flip. That is a different topology — not the default demo.

Mermaid — `-L` local forward

sequenceDiagram
  participant You as A your laptop
  participant B as B bastion
  participant C as C service :80

  Note over You: Listener on A :8080
  You->>You: curl 127.0.0.1:8080
  You->>B: SSH channel (-L)
  B->>C: B dials C:80
  C-->>B: response
  B-->>You: back through SSH

Mermaid — `-R` remote forward

sequenceDiagram
  participant You as A your laptop
  participant B as B bastion
  participant Svc as A service :8080

  Note over B: Listener on B :18080
  Note over Svc: Your lab HTTP on A
  B->>B: curl 127.0.0.1:18080
  B->>You: SSH channel (-R)
  You->>Svc: A dials 127.0.0.1:8080
  Svc-->>You: response
  You-->>B: back through SSH

Mermaid — side-by-side mental model

flowchart LR
  subgraph L["-L pull to me"]
    A1["A listens :8080"] --> SSH1["SSH"] --> B1["B dials C:80"]
  end
  subgraph R["-R push to them"]
    B2["B listens :18080"] --> SSH2["SSH"] --> A2["A dials my :8080"]
  end

Practitioner

Teach friends authorized SSH port forwarding only (HTB Academy / retired boxes / your own lab). Not a production bypass guide.

Actors

A = attacker / student laptop (authorized)
B = SSH bastion / foothold (you have a shell account)
C = internal service only reachable from B's network

One table to memorize

Flag	Who listens	Who opens the real TCP connect	Narrow use
`-L` local	A (usually `127.0.0.1`)	B	One known `host:port` on B's side
`-R` remote	B (usually its loopback)	A	One service on A that B must reach
`-D` dynamic	A (SOCKS)	B, per app request	Many tools / unknown ports through B

Mnemonic: -L pull one service to me · -R push one of mine to them · -D SOCKS exit via B.

Teaching path (this course)

Whiteboard + quiz (no commands) → whiteboard
-L lab → local-forward
-D lab → dynamic-forward
-R lab → remote-forward
Capstone (Academy / Vault / Poison / home lab) → capstone

HTB stack (operator pick)

Priority	Resource	Role in class
Curriculum	HTB Academy: Pivoting, Tunneling & Port Forwarding	Official `-L`/`-R`/`-D` labs
Best single box	Vault (Medium, retired; often VIP+)	Writeups exercise all three
Easier `-D`/`-L` demo	Poison (Medium, retired)	Localhost service → SOCKS/`-L`
`-R` focus	Registry (Hard) or 3-host home lab	When outbound to A is awkward

Student handout (published): SSH Tunneling · vault Published/1_RTO/1.4 Tunneling/SSH Tunneling.md

Non-negotiables for the room

Lab / HTB / owned hosts only
Prefer ssh -N, bind 127.0.0.1, ExitOnForwardFailure=yes
No GatewayPorts yes for classroom demos
Tear down: Ctrl-C → confirm listener gone (lsof / ss)

Deep dive

Optional: read OpenSSH ssh(1) forwarding section and peachcyber verification/cleanup before class [S-OSS-01 | high | primary] [S-PC-01 | high | primary].

Check

Friends can fill the listener / dialer columns for all three flags on a blank whiteboard.