Expose a server-side SOCKS proxy through remote dynamic SSH forwarding

Needs: A supporting OpenSSH client, allowed remote forwarding, listener binding and SOCKS-compatible tool clients

Run on the pivot

# Run on the pivot
ssh -N -R 127.0.0.1:1080 -p KALI_SSH_PORT KALI_USER@LHOST \
  -o ExitOnForwardFailure=yes \
  -o ServerAliveInterval=30 -o ServerAliveCountMax=3

These checks run on different machines; do not paste both into one terminal

The SOCKS listener appears on Kali and destination connections exit through the pivot. Remote dynamic forwarding requires OpenSSH 7.6 or later on the client that issues -R. Run ssh -V on the pivot (the SSH client). Run ss -lntp | grep 1080 on Kali (the SSH server hosting the SOCKS listener). These checks run on different machines; do not paste both into one terminal:

# These checks run on different machines; do not paste both into one terminal
ssh -V
ss -lntp | grep 1080

Verify → Verify the listener's actual location and source-side exit by application evidence.

If it fails → Unsupported client syntax or forwarding policy is different from destination filtering. Use a fixed remote forward if it satisfies the task. More detail ↓

If → then

A SOCKS listener or an SSH jump host is already available → Use ProxyChains, native SOCKS clients and SSH jump paths appropriately
Needs: Client/proxy transport compatibility, correct proxy configuration and controlled name resolution
The useful side can initiate SSH outward but cannot accept an inbound management connection → Expose an SSH-client-side destination through a server-side remote listener
Needs: Outbound SSH route, accepted identity, server forwarding/GatewayPorts policy and reachability to the chosen client-side destination
An IP connection works while hostname/Kerberos access fails → Preserve DNS, Kerberos names and time across a pivot
Needs: Reachable correct resolver/KDC path, matching target SPN/hostname, realm configuration and acceptable time

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Expose a server-side SOCKS proxy through remote dynamic SSH forwarding

USE WHEN: Only the pivot can initiate SSH, but several client-selected internal destinations are needed
STARTING ACCESS: A pivot identity/process or reachable SSH service and a drawn source-to-destination path
RESULT: A server-side SOCKS listener whose connections exit from the SSH client/pivot

Recognize the clue

For an outbound-only SSH path identify the need for several client-selected destinations and inspect the actual SSH client implementation/version.

ssh -V

SYNTHETIC EXAMPLE OUTPUT

SSH client: supported current OpenSSH
Outbound pivot -> server: allowed
Server-side SOCKS listener: required

Means: Remote listener placement plus per-connection SOCKS destination selection suggests remote dynamic forwarding.

Confirm: Check implementation support, remote-forward policy, listener binding and proxy-client/DNS compatibility.

After validation: A supported remote dynamic listener carries the intended TCP clients: choose that mode.
Ruled out in this context: The installed SSH client does not support the syntax or policy forbids it: reject that variant.
Still inconclusive: A version string without a controlled forwarding/application test leaves policy/transport unresolved.

Troubleshooting: Unsupported client syntax or forwarding policy is different from destination filtering. Use a fixed remote forward if it satisfies the task.

Run on the pivot:

The SOCKS listener appears on Kali and destination connections exit through the pivot. Remote dynamic forwarding requires OpenSSH 7.6 or later on the client that issues -R. Run ssh -V on the pivot (the SSH client). Run ss -lntp | grep 1080 on Kali (the SSH server hosting the SOCKS listener). These checks run on different machines; do not paste both into one terminal:

Why it works

Remote dynamic forwarding reverses listener placement while preserving per-connection SOCKS destination selection. OpenSSH implementation/version support must be checked.

Worked example · hypothetical

Observation: the pivot has a supported OpenSSH client and outbound SSH. Test: establish the documented remote dynamic listener and a single proxy-aware request. Illustrative output: the internal page returns. Interpretation: use the proxy with explicit DNS and TCP limitations.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗