At home I have a local server set up with some Samba shares. Evidently these are not exposed to the internet. I do however find myself on the move and wanting to access those shares. While I cannot get to them directly, I do have a raspberry pi on that network to which I can SSH from outside. To get to the Samba shares, I can tunnel traffic through that SSH connection. As with a lot of these things, it is hard to find out about it, but once you know it is simple enough to understand (or at least understand enough to get it working).

So to summarise, I have:

  • My laptop, somewhere on the move. The device I am sitting behind.
  • A network at home with
    • a server I can SSH into (my raspberry pi), and
    • another server that serves Samba shares locally, just for that home network. I want to access some of these Samba shares.

To get there takes just a few steps. First, we make the laptop listen for requests on another IP address. Particularly, we will add another IP address to the loopback interface. This first step is optional if you are on Linux, which already listens to everything in the 127.x.x.x range.

ifconfig lo0 alias

Running this command (you will likely need root), will make it so that if you send a request to, it will now be handled by the computer you ran it on. In my case, I run this on my laptop.

Next up, we will link port 139 on the address to port 139 on the Samba server. We link port 139 as this is used for Samba connections. This link will happen through the server we can SSH into. We use the -L flag of the SSH command, which expects a format of localipaddress:localport:remoteipaddress:remoteport to link the local stuff to the remote stuff. Suppose my Samba server is running on IP of my home network. I run the following command on my laptop.

ssh my-ssh-server -L -N -T

Note that local IP gets interpreted by the laptop, so I write down The remote one is understood by the SSH server I connect to, so I can just write down

The -N is to make the connection not bidirectional, it is safer. The -T will make it so you are not dropped into a shell of the SSH server. This way you do not forget you are using this connection as a tunnel. There is a chance you have to run this as root. If you do and you need your regular user’s SSH configuration, you can pass it along with the -F /path/to/ssh/config flag.

With this setup, if I am on my laptop and send a request to port 139 on IP address, my laptop will receive the request. My laptop will then pass the request on, through the connection it has to my SSH server, to the Samba server at the other end. In other words, I can now use my regular Samba client to connect to and see the Samba shares.

To finally make it a little bit cleaner, you can add a hostname in /etc/hosts. In the running example this would become	samba-server-at-home

Now I just need to tell my Samba client to connect to samba-server-at-home.

Assembled from: