skills.rest
lNwNl
lNwNlCOMMUNITY
Explore all skills by this author →
GitHub

tunneling-and-pivoting

Establish network tunnels and pivot routes to access internal services.

2|Updated May 15, 2026
Search Tags:#tunneling#proxychains#pivoting#socks proxy#ligolo-ng#network routing#ssh port forwarding
One-click install
npx skills add https://github.com/lNwNl/Methodos --skill tunneling-and-pivoting
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: tunneling-and-pivoting
Source: https://github.com/lNwNl/Methodos/tree/main/docker/opencode/skills/tunneling-and-pivoting
Command: npx skills add https://github.com/lNwNl/Methodos --skill tunneling-and-pivoting

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Tunneling and pivoting solve the problem of accessing services on internal networks when direct connectivity is blocked from your current machine.

Core Features & Use Cases

  • SSH tunneling for controlled reachability: Set up local, remote, and dynamic (SOCKS) forwards to route specific ports or entire flows through a compromised pivot host, including ProxyJump chaining.
  • Tool-based and transparent pivoting: Use Chisel reverse SOCKS for fast SOCKS proxying, Ligolo-ng for transparent TUN-based routing without a SOCKS layer, and route stacking for multi-layer pivots.
  • Alternate relays and constrained-environment techniques: Apply socat relays, ProxyChains multi-hop proxy configurations, and Windows pivoting via netsh portproxy and plink; extend access via DNS/ICMP/HTTP tunneling when egress rules force unusual transports.

Quick Start

Ask the assistant to generate a pivoting plan and exact setup steps for tunneling from a compromised host to an internal service using the best-fitting method for your egress constraints (SSH/Chisel/Ligolo-ng/socat/ProxyChains/DNS/ICMP/HTTP, including multi-layer routing if needed).

Frequently Asked Questions about tunneling-and-pivoting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I pivot into an internal network using SSH dynamic port forwarding?▼

SSH dynamic port forwarding creates a local SOCKS proxy that routes traffic through a compromised host to reach internal network services. You can chain multiple SSH hops using ProxyJump to establish multi-layer pivoting routes.

What is the best way to tunnel traffic when egress rules block standard ports?▼

When egress rules block standard ports, constrained transport tunneling via DNS, ICMP, or HTTP encapsulates traffic to bypass restrictions. You can combine these with multi-layer chaining and socat relays to maintain connectivity.

Can I use Ligolo-ng for transparent pivoting instead of a SOCKS proxy?▼

Yes, Ligolo-ng establishes transparent TUN-based pivoting without requiring a SOCKS layer. It provides a virtual network interface that routes traffic directly, unlike Chisel reverse SOCKS which requires proxy configuration.

How do I configure ProxyChains to route tools through a reverse SOCKS proxy?▼

ProxyChains wraps application traffic and routes it through configured SOCKS or HTTP proxies. You define the proxy chain in the configuration file to forward tool traffic through a Chisel reverse SOCKS tunnel to reach internal services.

Does this tunneling approach support Windows environments with netsh portproxy?▼

Yes, Windows pivoting is supported via netsh portproxy for port redirection and plink for SSH tunneling. These methods establish relay routes on Windows hosts to extend access into internal network segments.

Related Skills

Explore More Software Engineering Skills→
0x0pointer0x0pointer
13

post-exploit

Escalate privileges, harvest credentials, and enumerate compromised Linux and Windows hosts.

Official
Advanced
AcczdyAcczdy
2

conducting-internal-network-penetration-test

Simulate internal network penetration tests to reveal lateral movement and privilege escalation paths.

Community
Advanced
wgpsecwgpsec
1.6k

multi-layer-network

Coordinate multi-hop SSH, FRP, and Chisel tunnels with SOCKS proxies to pivot from a DMZ to internal networks.

Official
Advanced
kubonykubony
10

gcp-vm-ssh

Generate SSH commands and configure port forwarding tunnels for GCP VMs.

Community
Intermediate