TL;DR
Get monitors, keyboards and dev gear delivered free — and shop member deals
- Fast, free delivery on millions of items
- Access to Prime Big Deal Days deals on October 6–7
- Prime Video, Amazon Music and more included
A technical report by Vincent Bernat describes a way to publish a local web service through a self-hosted HTTP tunnel using OpenSSH remote forwarding and Nginx. The setup can issue expiring links, but it requires server administration, DNS and certificate configuration, and a helper script to find the forwarded port.
Vincent Bernat has published a self-hosted HTTP tunnel design that uses OpenSSH and Nginx to make a local web service available over HTTPS without a separate tunnel client. The approach is intended for tasks such as sharing a work-in-progress website preview, and adds time-limited access links to a remote SSH port forward.
The setup starts with OpenSSH forwarding a locally running service to a port on a remote server. By requesting remote port 0, the SSH server selects an available port; Bernat’s example reports that port as 41535. Nginx then accepts HTTPS requests for a hostname containing that port and proxies them to the corresponding local port on the server.
Public access depends on the operator configuring a wildcard DNS record and obtaining a wildcard TLS certificate. Bernat’s report uses Let’s Encrypt and describes DNS-based certificate validation. These requirements mean the method assumes control of a server and domain, rather than providing the ready-made infrastructure offered by hosted tunnel services.
For access control, the report uses Nginx’s secure link module to validate a hash associated with the forwarded port and an expiration time. An accepted link can be configured to expire; requests with a missing or invalid hash receive a 401 response, while an expired link receives a 410 response. Bernat also describes a helper script that locates the port allocated to the SSH session, creates the link, prints it, and keeps the session open.
The design offers developers a way to share a local preview while keeping the forwarding infrastructure on a server they administer. That can be useful when a reviewer needs to see a site before it is deployed, or when an operator prefers not to route preview traffic through a commercial tunnel provider. It also relies on familiar components—OpenSSH and Nginx—rather than requiring a dedicated client on the machine running the local service.
The trade-off is operational responsibility. The operator must maintain the server, DNS, TLS certificate process, Nginx configuration, and SSH access. The expiring hash link is an access-control measure, but it does not remove the need to protect the server or to share the URL carefully. The report presents a working implementation, not comparative testing or a claim that the arrangement is more secure or easier than hosted alternatives.
As an affiliate, we earn on qualifying purchases.
From SSH Port Forward to HTTPS Link
SSH remote forwarding lets a connection arriving at a remote server’s port travel back through the SSH session to a service on the client machine. In Bernat’s example, that service is available at localhost:8080. Nginx provides the public HTTPS endpoint and routes requests based on the port embedded in the hostname.
Bernat contrasts the approach with hosted options such as ngrok and Cloudflare Quick Tunnels, as well as self-hostable tools that may require their own client or a particular SSH server. The stated aim is to build the tunnel with standard OpenSSH and Nginx. The published helper addresses a practical gap: OpenSSH allocates the remote port, but the report says that port is not exposed through an environment variable, so the script inspects processes and listening sockets to find it.
As an affiliate, we earn on qualifying purchases.
Operational Limits and Security Questions
The report documents one configuration, but does not provide independent security testing, performance measurements, or a comparison of reliability with hosted tunnel services. It is also not clear from the material how the design would behave under multiple concurrent forwards, unusual SSH configurations, or a larger number of users. The port-discovery script requires permission to inspect listening processes, and its operation depends on the server’s process and socket-reporting setup.
The link’s expiration and hash validation restrict access as configured, but the article does not establish that the URL is suitable for every confidential service or threat model. Operators would need to review their own secret management, access policies, logging, and network exposure. The example’s fixed secret is illustrative configuration, not a recommendation to reuse that value.
Let’s Encrypt wildcard SSL certificate
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Deployment Depends on Local Setup
Bernat’s report describes implementation steps rather than announcing a product roadmap or release schedule. Anyone adopting the method would need to configure remote SSH forwarding, Nginx, wildcard DNS, and certificate issuance, then test the generated links and expiration behavior in their environment.
The next practical step for readers is to consult the original report’s full configuration and helper-script details, then assess whether maintaining the required server infrastructure fits their needs. No broader rollout, maintenance commitment, or independent validation is specified in the source material.
As an affiliate, we earn on qualifying purchases.
Key Questions
What does the tunnel do?
It routes HTTPS requests from a public Nginx endpoint through an SSH remote forward to a service running on a local machine, such as a development preview.
Does it require a dedicated tunnel client?
The described forwarding uses an OpenSSH client, while Nginx handles incoming web traffic on the server. The report’s aim is to avoid a separate, tunnel-specific client.
How are shared links restricted?
Nginx checks a hash tied to the forwarded port and an expiration time. According to the report, invalid or missing credentials receive a 401 response, and expired links receive a 410 response.
What infrastructure does an operator need?
The setup requires an SSH-accessible server, Nginx, control of a suitable domain and wildcard DNS, and a TLS certificate. The example also uses a helper script to identify the port selected by OpenSSH.
Is this presented as a tested replacement for hosted services?
No. The source describes an implementation, but does not report comparative benchmarks, independent security testing, or evidence that it is more reliable or secure than hosted alternatives.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
