Pascal (Lazarus/Delphi)

SSH Tunnel Static (Fixed-Destination) Port Forwarding

Demonstrates fixed-destination port forwarding with the DestHostname, DestPort, ListenBindIpAddress, and ListenPort properties. Every local connection accepted by the listener is forwarded to the same fixed destination through the SSH server.

Background: This is the classic ssh -L scenario: expose a single remote service — a database, an internal web app — at a local port. Binding the listener to 127.0.0.1 keeps the tunnel private to the local machine, whereas 0.0.0.0 would let other hosts route through it. Passing 0 to BeginAccepting lets the OS pick a free port, which ListenPort then reports — handy when a fixed port might already be in use.

Chilkat Pascal (Lazarus/Delphi) Downloads

Download Chilkat for Pascal (Lazarus/Delphi)

Pascal (Lazarus/Delphi)

program ChilkatDemo;

// Demonstrates using the Chilkat Pascal wrapper via the C bridge DLL.
// Builds as a console application under Lazarus (FPC) or Delphi.

{$IFDEF FPC}
  {$MODE DELPHI}
{$ENDIF}
{$APPTYPE CONSOLE}

uses
  {$IFDEF UNIX}
  cthreads,
  {$ENDIF}
  SysUtils,
  CkDllLoader,
  Chilkat.SshTunnel;

// ---------------------------------------------------------------------------

procedure RunDemo;
var
  success: Boolean;
  tunnel: TSshTunnel;
  sshPort: Integer;
  password: string;
  waitForThreadExit: Boolean;

begin
  success := False;

  //  Demonstrates fixed-destination (static) port forwarding with the SshTunnel properties
  //  DestHostname, DestPort, ListenBindIpAddress, and ListenPort.
  //  
  //  Every local connection accepted by the listener is forwarded to the same fixed destination
  //  through the SSH server.

  tunnel := TSshTunnel.Create;

  //  The fixed destination that accepted connections are forwarded to.
  tunnel.DestHostname := 'db.internal.example.com';
  tunnel.DestPort := 5432;

  //  Bind the listener to loopback so only local processes can use the tunnel.  Use "0.0.0.0" to
  //  accept connections from other machines (less secure).
  tunnel.ListenBindIpAddress := '127.0.0.1';

  sshPort := 22;
  success := tunnel.Connect('ssh.example.com',sshPort);
  if (success = False) then
    begin
      WriteLn(tunnel.LastErrorText);
      Exit;
    end;

  //  Normally you would not hard-code the password in source.  You should instead obtain it
  //  from an interactive prompt, environment variable, or a secrets vault.
  password := 'mySshPassword';

  success := tunnel.AuthenticatePw('mySshLogin',password);
  if (success = False) then
    begin
      WriteLn(tunnel.LastErrorText);
      Exit;
    end;

  //  Pass 0 to let the operating system choose an available port.  After BeginAccepting succeeds,
  //  ListenPort contains the actual port that was bound.
  success := tunnel.BeginAccepting(0);
  if (success = False) then
    begin
      WriteLn(tunnel.LastErrorText);
      Exit;
    end;
  WriteLn('Listening on 127.0.0.1 port ' + tunnel.ListenPort);

  //  Applications now connect to 127.0.0.1:ListenPort as if it were the database server.

  waitForThreadExit := True;
  success := tunnel.CloseTunnel(waitForThreadExit);
  if (success = False) then
    begin
      WriteLn(tunnel.LastErrorText);
      Exit;
    end;


  tunnel.Free;

end;

// ---------------------------------------------------------------------------

begin

  try
    RunDemo;
  except
    on E: Exception do
      WriteLn('Unhandled exception: ', E.ClassName, ': ', E.Message);
  end;

  WriteLn;
  {$IFDEF MSWINDOWS}
  WriteLn('Press Enter to exit...');
  ReadLn;
  {$ENDIF}
end.