Oracle Cloud Bastion: Dynamic Port Forwarding (SOCKS5) Guide

Managing access to isolated cloud infrastructure can be challenging. While traditional VPNs are highly secure, they often introduce administrative overhead and broad network exposure. Dynamic Port Forwarding using a SOCKS5 proxy via Oracle Cloud Infrastructure (OCI) Bastion offers a highly secure, lightweight, and application-specific messaging alternative. This approach allows you to route traffic to multiple private resources inside your Virtual Cloud Network (VCN) through a single, secure SSH tunnel.

In this guide, we will walk you through setting up an OCI Bastion dynamic port forwarding session, establishing the SOCKS5 tunnel, and configuring various clients such as SSH, web browsers, and database engines to securely access your private cloud resources.

Part 1: Creating the Dynamic Port Forwarding Session

Step 1: Navigate to Bastion Service

1. Log in to the OCI Console.
2. Go to Identity & Security → Bastion.
3. Select your Bastion service from the list.

Step 2: Create New Session

1. Click the Create session button.
2. Configure the session parameters:
   • Session type: Select Dynamic port forwarding.
   • Session name: Enter a descriptive name (e.g., dev-dynamic-session).
   • Session TTL: Choose the duration (default: 3 hours, maximum: 3 hours).
3. Click Create session.

Step 3: Wait for Session Activation

• The session status will change from Creating to Active (this usually takes approximately 1 minute).
• Once active, the session is ready for connection.

Step 4: Get Connection Details

1. Click the three dots (⋮) menu next to your active session.
2. Select Copy SSH command.
3. The command will look similar to the following:

ssh -i <privateKey> -N -D 127.0.0.1:<localPort> -p 22 ocid1.bastionsession.oc1.me-dubai-1.amaaaaaaatrw5lya2njvik3ax7ngtdiai35fcvasyr2oozslejzrmvhr6alq@host.bastion.me-dubai-1.oci.oraclecloud.com

Part 2: Establishing the SOCKS5 Tunnel

Modify the SSH Command

Convert the copied command to the dynamic port forwarding format by specifying your local SSH key path and mapping your preferred local port (e.g., 1080):

ssh -i /ssh/key/path -N -D 127.0.0.1:1080 -p 22 ocid1.bastionsession.oc1.me-dubai-1.amaaaaaaatrw5lya2njvik3ax7ngtdiai35fcvasyr2oozslejzrmvhr6alq@host.bastion.me-dubai-1.oci.oraclecloud.com

Command Parameters Explained:

• -D 1080: Creates a SOCKS5 proxy on local port 1080 (you can use any available port on your system).
• -N: Prevents execution of remote commands; this flags the connection to establish a tunnel only.
• -p 22: Specifies the default SSH port.

Execute the Command

1. Open a terminal window.
2. Run the modified SSH command.
3. The terminal will appear to “hang” with no returning output this is normal behavior.
4. The SOCKS5 proxy is now active on localhost:1080.
5. Keep this terminal window open closing it will immediately terminate the tunnel.

Part 3: Accessing Private Resources

Method 1: SSH to Private VMs (Using ProxyCommand)

Option A: Using SSH Config File (Recommended)

To simplify connections, create or edit your ~/.ssh/config file as follows:

Host my-private-vm
    HostName 10.0.1.5
    User opc
    IdentityFile ~/.ssh/vm-key
    ProxyCommand nc -X 5 -x localhost:1080 %h %p

Host another-vm
    HostName 10.0.1.10
    User opc
    IdentityFile ~/.ssh/vm-key
    ProxyCommand nc -X 5 -x localhost:1080 %h %p

Once saved, you can easily connect to your target VM using:

ssh my-private-vm

Option B: One-liner SSH Command

If you prefer not to edit your configuration file, run this single command to proxy the connection:

ssh -o ProxyCommand='nc -X 5 -x localhost:1080 %h %p' -i ~/.ssh/vm-key opc@10.0.1.5

If using ncat (from the nmap package):

ssh -o ProxyCommand='ncat --proxy-type socks5 --proxy localhost:1080 %h %p' -i ~/.ssh/vm-key opc@10.0.1.5

Method 2: Access Private Web Services via Browser

Firefox Configuration:

1. Open Firefox Settings.
2. Navigate to the bottom and select Network Settings → Settings.
3. Select Manual proxy configuration.
4. Configure the proxy settings detailed below:
   • SOCKS Host: localhost
   • Port: 1080
   • SOCKS v5: Checked
   • Proxy DNS when using SOCKS v5: Checked
5. Click OK.
6. You can now access your private web services in the browser: http://10.0.1.5:8080.

Method 3: SCP File Transfer

Securely transfer files directly to or from your private VMs through the SOCKS5 proxy:

scp -o ProxyCommand='nc -X 5 -x localhost:1080 %h %p' -i ~/.ssh/vm-key /local/file opc@10.0.1.5:/remote/path

scp -o ProxyCommand='nc -X 5 -x localhost:1080 %h %p' -i ~/.ssh/vm-key opc@10.0.1.5:/remote/file /local/path

Method 4: Database Connections

Many modern database GUI clients natively support SOCKS5 proxies. Work with your client of choice using these parameters:

• Proxy Type: SOCKS5
• Proxy Host: localhost
• Proxy Port: 1080
• Database Host: Your cloud instance private IP (e.g., 10.0.1.20)
• Database Port: Use the default database engine port (e.g., 1521 for Oracle, 3306 for MySQL, 5432 for PostgreSQL).

Part 4: Testing and Verification

To verify that your SOCKS5 proxy tunnel is actively running and listening on your local machine, run one of the following commands in an independent terminal window:

# Check if port 1080 is listening
netstat -an | grep 1080

# Or using lsof (macOS/Linux)
lsof -i :1080

An active SSH process listening on port 1080 indicates a successful and functional connection.

Part 5: Keep the Tunnel Session Alive

SSH tunnels can terminate due to inactivity timeouts. To prevent unexpected disconnects during longer operations, append keep-alive parameters to your SSH command:

ssh -i key -D 1080 -N -o ServerAliveInterval=60 -o ServerAliveCountMax=3 session@bastion

Conclusion

SOCKS5 dynamic port forwarding via OCI Bastion is a powerful utility for systems engineers and cloud architects. By routing various protocols, file transfers, browser sessions, and databases through a single SSH connection, you maintain a high level of operational security without complicating network paths. Utilizing host configurations and keep-alive packets allows you to incorporate this step seamlessly into your day-to-day administrative workflow.