Is it right to assume, that when i build up a tunnel with ssh -D from outside my LAN and then access my only locally exposed server via FTP, it can be called 'safe'? Tunnel is established on the same device, where i configure FileZilla to use the generic (SOCKS) proxy from 'localhost'. So the only unencrypted part would be the way from the outgoing SSH tunnel in the LAN to the server in the same network (where only i have access to), right? Tunnel device and FTP server are not the same.

I am more or less sure about this setup, but it just feels strange to send (private) data over the internet via FTP. Anything i miss?

Thank you in advance!

2 Answers 2


If you are interested on the connection between you computer and the FTP server, then yes, it's secure. Everything is running inside the SSH tunnel, it's encrypted and any regular or skilled attacker won't be able to read the FTP data or alter the traffic.

If you are a target of national state hackers, that could not be the case. But we assume you aren't.


Safe is against attack vectors, not an absolute state. Over any network (inter or intranet) data within a properly configured SSH tunnel can be assumed to be safe against most attacks.

An SFTP server would likely close any gaps in the transmission chain and be considered safe from any attacker which does not have control over the server. It is in many ways exactly what you're describing (FTP over SSH). It just happens that the unencrypted part is inside the application, greatly reducing risk. Filezilla Server supports FTP over TLS by my reading of their forums which likely has similar security assurances.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .