Add Microsoft KM-TEST Loopback Adapter for required extra server connections using hdwwiz.exe:

1. Edit properties and disable everything except TCP/IPv4.
2. Set an IP e.g. 192.168.2.123 with subnet mask 255.255.255.0 and disable NetBIOS.
3. Add an Interface Metric of 9999 such that it is lowest priority.
4. Ensure SMB v1 is disabled (Turn Windows features on or off).

Note that physical servers might be allocated to a single connection locally e.g. all could be mapped to 127.0.0.1 if the port numbers where unique. This method is required to ensure Windows File Sharing is working locally as well as via ssh because connections to multiple devices on the same port 445 are required. The same reasoning also occurs below for connections to two seperate web-servers on port 80.

Example set in host file:

#127.0.0.1     some-server.somewhere.as.required alias another-alias #comment

192.168.2.123 myworkpc.myworkdomain.com myworkpc #445 -> 44445 (reminder of which ports intending to use for this 2nd IP local subnet)
192.168.2.123 myalias #80 -> 8080 (nb: these ports are actually set below)
192.168.3.123 anotherPClongname.myworkdomain.com anotherPClongname anotherPC #80 -> 8081 (note that this is 3rd IP local subnet to avoid conflict with above)

One time only (persistant) otherwise elevated permission would be required for ssh (cant tunnel ports below 1024 as user):

netsh interface portproxy add v4tov4 listenaddress=192.168.2.123 listenport=80 connectaddress=192.168.2.123 connectport=8080
netsh interface portproxy add v4tov4 listenaddress=192.168.3.123 listenport=80 connectaddress=192.168.3.123 connectport=8081
netsh interface portproxy add v4tov4 listenaddress=192.168.3.123 listenport=443 connectaddress=192.168.3.123 connectport=10443

See also Additional actions for port 445. The above netsh commands have redirected ports lower than 1024 to the higher port numbers (ready for the SSH tunnel to use) but so far nothing is using them.

Use these ports in the SSH command line (SSH to this host from a remote client, setting up a tunnel from the remote server side instead of -L local client side):

-R 192.168.2.123:8080:192.168.12.34:80
-R 192.168.3.123:8081:anotherWebServer.workDomain-instead-of-ip.work.com:80
-R 192.168.2.123:44445:someWorkPC.workDomain-instead-of-ip.work.com:445

Here for example, a webserver on client network at 192.168.12.34:80 (assuming it is accessible when dsat at the client PC) can be accessed from the ssh-server PC by visiting 192.168.2.123:80 on the server PC, which was redirected using the netsh command to 192.168.2.123:8080, which is then being listened to by the ssh-server (after the connection is made using the -R option above) and tunnelled to 192.168.12.34:80 within the client network.

Generally, the remote connection requests a tunnel to be created on the specified interface and port. SSH server will listen for connections to these ports and direct them to the SSH client. SSH client will forward them to the specified location (inside the corporate network).

It may not be necessary to use 8081 on second interface but there were some unusual behaviours occuring when connecting to different web servers in this manner which were fixed by using only one "instance" of a port 8080 tunnel i.e. one tunnel of port 8080 and one of 8081 rather than two 8080's.

From https://www.nikhef.nl/~janjust/CifsOverSSH/Win10Loopback.html and https://superuser.com/questions/1094931/ssh-tunnel-on-windows-10-to-linux-samba

File share needs to be accessed using TCP port 445. It needs to be on a seperate interface to represent another PC. However, lanmanserver driver uses this port for all interfaces. So it is required to delay startup of lanmanserver (make sure IpHlpSvc driver is running) and install a portproxy rule. Start console window (run as administrator):

sc config lanmanserver start= delayed-auto
sc config iphlpsvc start= auto
netsh interface portproxy add v4tov4 listenaddress=192.168.2.123 listenport=445
    connectaddress=192.168.2.123 connectport=44445

Confirm lanmanserver is running and rule is correctly applied:

sc query lanmanserver
netstat -an | find ":445"

This should show both 0.0.0.0:445 and 192.168.2.123:445 listening. Remote tunnel from 192.168.2.123 using SSH (port 44445). Add more loopback adaptors with different IP addresses (and incremental port numbers using netsh for same reasons as given for 8080 vs 8081 above) for each Samba share if needed.

1. Allow localport 22 in/out from Work IP only, TCP only.
2. Optionally: Allow localport 22 in/out from local server intranet, TCP only.
3. Block localport 22 in/out from any IP, TCP/UDP (make sure the firewall rule ordering does not cancel the above).

Port forward NAT (broadband router) port 22 to the server PC at home.