If I wish to run Nessus against a Windows server that is only accessible from another machine, I can setup an SSH tunnel like so:

ssh [email protected] -L -L

Then I would configure Nessus to scan localhost or with credentialed checks, using the Windows admin username and password.

Trouble is that Nessus detects that it has command execution on my local Linux host and mixes the results from the target host with my local host.

Not normally a problem as I should be able to differentiate Linux results from Windows, but just wondered if there was a way to tell Nessus not to query the local machine in the interests of clean separation of results.

Note that limiting the ports to 139 and 445 and setting the Test the local Nessus host setting have no effect on this.

  • Maybe try listening and attacking, another option is to use ssh -D and run nessus with proxychains, or if nessus has support for proxies configure it. Jun 7, 2017 at 15:52

1 Answer 1


You could instead set up a layer 3 tunnel over SSH and route directly to the windows target (see below link for example).


This would solve the issue of you scanning the linux target as you will be able to scan the windows IP address directly.

You could also use a tool called sshuttle for this, but I find that can be a little buggy sometimes.

  • 1
    This is a link-only answer. Please include the relevant parts of the link in your answer. And explain how this solves the issue.
    – schroeder
    Oct 30, 2020 at 16:25
  • @schroeder, the wiki link I shared is an example of how to setup a layer 3 tunnel over SSH. This solves the issue since instead of scanning you can route directly to your target IP address. Oct 31, 2020 at 0:51
  • **Please include the relevant parts of the link in your answer. ** And edit your question to provide the relevance.
    – schroeder
    Oct 31, 2020 at 8:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .