When a developer wants to share a work‑in‑progress site running on localhost, the usual options are commercial services like ngrok or Cloudflare Quick Tunnels, or self‑hosted tools that require a dedicated client. Bernat demonstrates that the same result can be achieved with only the OpenSSH client/server pair already present on most servers and an nginx reverse proxy.
The technique relies on SSH’s remote port forwarding with a zero port specifier (`ssh -R 0:localhost:8080 user@remote`). When the remote port is set to zero, the SSH server allocates a free high‑numbered port and reports it back. Nginx is configured with a regular expression server name (`~^p(?<port>\d{5})\.ssh\.example\.cx$`) that captures that port and uses it in a `proxy_pass` directive to forward the request to `http://127.0.0.1:$port`. To prevent anyone who guesses the port from accessing the service, the setup employs nginx’s `ngx_http_secure_link_module`. The client builds a URL that contains a base64‑encoded MD5 hash of an expiration timestamp, the allocated port, and a shared secret; nginx verifies the hash and returns 401 or 410 if the signature is missing or expired.
Because the kernel’s ephemeral port range supplies only about 15 bits of entropy, the allocated port can be brute‑forced, which is why the signed link adds a necessary layer of protection. The method still requires a wildcard DNS record (`*.ssh.example.cx`) and a TLS certificate, which can be automated with Let’s Encrypt. For users who prefer a ready‑made tunneling server with extra features, the open‑source project sish provides HTTP(S), WS(S) and TCP tunneling, a web console for inspecting traffic, TCP aliases for private jump hosts, and SNI‑based routing, all running as a single SSH server.
The article mentions sish as an open-source project offering ready-made tunneling server with extra features beyond the basic SSH/nginx setup.