Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an unreliable network connection between two machines: sometimes active TCP connections get dropped for reasons beyond my control. I want to establish a reliable TCP connection between the two machines.

If the network was reliable, I'd just run ssh -L 1234:localhost:1234 remotehost, with the server listening on port 1234 on remotehost, and point the client at localhost:1234. But if the ssh connection dies, so will the forwarded connection. How can I arrange to automatically restore the connection between the client and the server?


  • This isn't for interactive applications, so screen does not apply.
  • This isn't just about reconnecting an SSH tunnel automatically, à la autossh. I want to continue using the same tunneled TCP connection, not start a new one.
  • In principle, a VPN would do the trick. But it seems overkill when I just want one TCP connection, and I'd like a solution that works even if I don't have root permissions on either side.

I have a dim memory of a program called rocks that did just that, but it seems to have fallen off the face of the web. I'm mostly interested in Linux on both sides (though I'd expect a program at this level to be portable to other unices), but if you know of a program that works between QNX and VMS, all the better.

share|improve this question
Gilles, are you using tcp keepalives with your ssh connections? If not, try this first... some NAT implementations time connections out quickly –  Mike Pennington May 30 '11 at 23:12
@Mike: Thanks for the tip. I don't have an immediate need, but I've faced both situations where some intermediate route came and went (so TCP keepalives did more harm than good) and situations where a NAT overloaded and dropped me (so TCP keepalives might help). TCP keepalives wouldn't matter for a continuous stream anyway (e.g. scp), would they? In any case I'd like to keep this general: next time I'm faced with a flaky network of whatever flavor, what can I do? –  Gilles May 30 '11 at 23:19
Gilles, the solutions are different for constant streams like scp. I was responding w/ ssh keepalives based on your port-forwarding example. Re: flaky downstream hop, there isn't much you can do, other than create an ssh session with keepalives that are more tolerant (i.e. allow more dropped keepalives with ServerAliveInterval > 0 and ServerAliveCountMax > 3). NAT requires lower keepalives intervals. The key issue is to identify what the problem is and tailor accordingly. Put the options in .ssh/config so they are always there for you –  Mike Pennington May 30 '11 at 23:26
@Mike: One of my use cases includes the client getting its IP from an overloaded NAT than randomly drops even active connections (think more P2P than there should be). After a few seconds, the client manages to reconnect but might get a different IP address. There's no way the TCP connection will survive in that case. Rocks copes, but I'd prefer something that compiles out of the box on today's systems. –  Gilles May 30 '11 at 23:31
in the case of the NAT giving you new IPs, there isn't much you can do than get the NAT fixed or hope for another rocks implementation... although this is obviously a real kludge –  Mike Pennington May 30 '11 at 23:36
add comment

2 Answers

Is the old an unmaintained Reliable Sockets (Rocks) what you're looking for ?

share|improve this answer
Thank you, Rocks is indeed what I remembered. Of course I'd prefer something that's maintained. –  Gilles May 30 '11 at 20:47
add comment

You could use daemontools to keep the ssh port forward up; it won't necessarily keep programs depending on the connection alive while it's down (as presumably when ssh disconnects the local port will start refusing their connections), but it's a start.

I suspect there are some iptables tricks, like causing that port to DROP packets as soon as the ssh forward goes away, so the connecting programs just know that packets are disappearing, not being refused. I'm just learning daemontools myself (again) so I'm not sure if you can run a custom script when a service dies, but I suspect you can.

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.