SSH Tunneling as Mini-VPN

The pre-WireGuard pattern

Before WireGuard and Tailscale, SSH port forwarding (Track 3) was how people did remote access. It still works, requires nothing beyond SSH, and is the right tool for one-off bridges where setting up a full VPN would be overkill.

Three patterns from Track 3, applied as VPN

LocalForward — "give me access to a remote service via my localhost." One-shot bridges to a database, a web admin UI, a metrics dashboard.
SOCKS proxy — "route browser traffic through this server." Effectively, a tiny user-space VPN for HTTP-shaped traffic.
Wake-on-LAN — wake a sleeping Mac on the LAN by SSH'ing into a wakeup-relay machine and sending a WoL packet from there.

Dynamic DNS for home IP

If you're not using Tailscale and your home has a dynamic public IP, a dynamic-DNS service maps a stable domain (yourname.duckdns.org) to whatever IP your ISP gave you today. Combine that with port-forwarded SSH on a non-default port + key-only auth + fail2ban (Track 8) and you have a workable, if old-school, remote access pattern.

Code

Mini-VPN patterns·bash

# Local forward: reach a remote web app
ssh -NfL 8080:localhost:80 office
# Open http://localhost:8080

# SOCKS proxy: route browser through office's connection
ssh -NfD 1080 office
# Set browser to SOCKS5 localhost:1080

# Verify the SOCKS proxy works
curl --socks5-hostname localhost:1080 https://ifconfig.me
# Should report office's public IP, not yours

# Wake-on-LAN — wake a sleeping Mac
brew install wakeonlan
ssh always-on-host "wakeonlan AA:BB:CC:DD:EE:FF"

# Dynamic DNS update from cron (DuckDNS example)
curl -fsS "https://www.duckdns.org/update?domains=mynetwork&token=$TOKEN&ip=" >/dev/null

SSH Tunneling as Mini-VPN

The pre-WireGuard pattern

Three patterns from Track 3, applied as VPN

Dynamic DNS for home IP

Code

External links

Exercise

Progress

Comments 0