Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have three computers, A, B and C. A has initiated a reverse ssh tunnel to B.

ssh  -nTNx -p 443 -R 22222:localhost:22 [user]@[server]

If I log in to B, I can use 'ssh -p 22222 localhost' and I get a login prompt for A. If I try 'ssh -p 22222 [public IP of B]', it doesn't work

What I would like to be able to do is have C connect to A without needing to login to B. So from C I could 'ssh -p 22222 [public IP of B]' and I would get the login prompt for A.

I am using debian and shorewall and I have a basic understanding of how things work. I have tried various combinations of REDIRECT and DNAT rules, but haven't had any luck. I have tried using the same port (22222) and a different port (forwarding 22223 from C to 22222 on localhost).

Any ideas?

share|improve this question
up vote 3 down vote accepted

See the "Remote port forwarding for anyone at work !" section of this webpage. The article suggests that you should add the

GatewayPorts yes

option to your sshd_config on your HostB. That should cause the remote port forwarding on your HostB to listen on all of its network interfaces.

share|improve this answer
The GatewayPorts did it! Thanks. – Ben Holness Apr 27 '10 at 2:22

Have you tried the -g flag in your ssh command? That's what tells it to allow remote systems to connect to local ports. So you'd do something like:

hostB$ ssh -g -L22222:localhost:22 user@hostA

Then from host C, this should work:

hostC$ ssh -p22222 user@hostB
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.