# Customized SSH port forwarding - for TCP/IP tunnelling? **URL:** \ **Category:** Questions / Help\ **Tags:** ssh\ **Created:** [August 3, 2022, 2:52pm UTC](https://erlangforums.com/t/customized-ssh-port-forwarding-for-tcp-ip-tunnelling/1710 "2022-08-03T14:52:43Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![teamon](https://erlangforums.com/user_avatar/erlangforums.com/teamon/32/1585_2.png) [@teamon](https://erlangforums.com/u/teamon)\ **Post date:** [August 3, 2022, 2:52pm UTC](https://erlangforums.com/t/customized-ssh-port-forwarding-for-tcp-ip-tunnelling/1710/1 "2022-08-03T14:52:44Z")
Recently I’ve been looking into OTP ssh package, and I’ve noticed there is a support for port-forwarding built-in into the `ssh:daemon/3`. I know there is a way to implement a custom ssh shell. I’m wondering if there is a similar customization option for TCP/IP tunnelling? Has anyone maybe tried to do it and could point me to the correct place? Thanks in advance. ---
**Author:** ![maxlapshin](https://erlangforums.com/user_avatar/erlangforums.com/maxlapshin/32/1593_2.png) [@maxlapshin](https://erlangforums.com/u/maxlapshin)\ **Post date:** [August 4, 2022, 4:34pm UTC](https://erlangforums.com/t/customized-ssh-port-forwarding-for-tcp-ip-tunnelling/1710/2 "2022-08-04T16:34:44Z")
as far as I remember, my friend made required support for data channels to ssh: [TCP/IP tunneling over SSH connections (aka port forwarding) by HansN · Pull Request #2376 · erlang/otp · GitHub](https://github.com/erlang/otp/pull/2376) We haven’t adopted it to our corporate ssh proxy, so I do not remember if it works, check it please. It should help you. ---
**Author:** ![teamon](https://erlangforums.com/user_avatar/erlangforums.com/teamon/32/1585_2.png) [@teamon](https://erlangforums.com/u/teamon)\ **Post date:** [August 4, 2022, 5:02pm UTC](https://erlangforums.com/t/customized-ssh-port-forwarding-for-tcp-ip-tunnelling/1710/3 "2022-08-04T17:02:49Z")
I know that one can setup a functioning port forwarding over ssh - that’s built-in and works just fine. What I’m looking for is a way to provide a customized behaviour, for example: User want to open a tunnel from server like `ssh -R foobar:80:localhost:4444` and I’d like to capture that request and for example modify host/port part from `foobar:80` to `foobar.my.local.net:1234` . I _guess_ I’m looking for a way to customize this piece - [otp/ssh\_connection.erl at OTP-25.0.3 · erlang/otp · GitHub](https://github.com/erlang/otp/blob/OTP-25.0.3/lib/ssh/src/ssh_connection.erl#L918) - other than forking otp itself. ---
**Author:** ![hansn](https://erlangforums.com/user_avatar/erlangforums.com/hansn/32/193_2.png) [@hansn](https://erlangforums.com/u/hansn)\ **Post date:** [August 5, 2022, 7:11am UTC](https://erlangforums.com/t/customized-ssh-port-forwarding-for-tcp-ip-tunnelling/1710/4 "2022-08-05T07:11:33Z")
Maybe a PR with a new ssh option that modifies the {ListenAddrStr, ListenPort} pair? The option could take a fun which takes that pair as input and returns a new pair. ---
**Author:** ![eFix](https://erlangforums.com/letter_avatar_proxy/v4/letter/e/858c86/32.png) [@eFix](https://erlangforums.com/u/eFix)\ **Post date:** [October 24, 2022, 2:56pm UTC](https://erlangforums.com/t/customized-ssh-port-forwarding-for-tcp-ip-tunnelling/1710/5 "2022-10-24T14:56:22Z")
I’m facing a similar challenge. If customization is not available, is there a way to notice, when a client opens a tunnel and the port it’s using? Connect callback isn’t called for a connection that only opens a tunnel, same for dbg msg callback. Thanks in advance 🙂 ---
**Author:** ![kuba](https://erlangforums.com/user_avatar/erlangforums.com/kuba/32/194_2.png) [@kuba](https://erlangforums.com/u/kuba)\ **Post date:** [November 2, 2022, 7:05am UTC](https://erlangforums.com/t/customized-ssh-port-forwarding-for-tcp-ip-tunnelling/1710/6 "2022-11-02T07:05:27Z")
I am not aware of a civilized way for being notified about tunnel being opened. Can you explain the use case more? Are you after some auditing functionality on SSH server side? ---
**Author:** ![eFix](https://erlangforums.com/letter_avatar_proxy/v4/letter/e/858c86/32.png) [@eFix](https://erlangforums.com/u/eFix)\ **Post date:** [November 2, 2022, 12:39pm UTC](https://erlangforums.com/t/customized-ssh-port-forwarding-for-tcp-ip-tunnelling/1710/7 "2022-11-02T12:39:23Z")
Thanks for your response. Auditing functionality is one aspect. The idea is to build a ssh reverse tunneling reverse proxy. My servers are not accessible from the outside, so they should open a tunnel on to erlang server forwarding their port 22 locally, which can be securely accessed from the admins via a ssh reverse proxy - to not been required to share private keys or have many public keys per server. For this reason the ssh reverse proxy needs to know, which tunnel/local port belongs to whom. This project inspired me: [GitHub - flussonic/ssh-proxy: SSH proxy that allows support agents go to customers servers with using intermediate corporate SSH key](https://github.com/flussonic/ssh-proxy) ---
**Author:** ![maxlapshin](https://erlangforums.com/user_avatar/erlangforums.com/maxlapshin/32/1593_2.png) [@maxlapshin](https://erlangforums.com/u/maxlapshin)\ **Post date:** [November 6, 2022, 9:58am UTC](https://erlangforums.com/t/customized-ssh-port-forwarding-for-tcp-ip-tunnelling/1710/8 "2022-11-06T09:58:53Z")
I’m glad that our project is inspiring someone. It is used in production (with some minor changes in private branch) ---
**Author:** ![eFix](https://erlangforums.com/letter_avatar_proxy/v4/letter/e/858c86/32.png) [@eFix](https://erlangforums.com/u/eFix)\ **Post date:** [August 14, 2023, 7:51pm UTC](https://erlangforums.com/t/customized-ssh-port-forwarding-for-tcp-ip-tunnelling/1710/9 "2023-08-14T19:51:42Z")
To implement the desired behaviour, I’m redefining the module ssh\_tcpip\_forward\_acceptor to accept opening tunnel only under valid conditions. Is redefining of modules a good approach?