Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have googled and haven`t found the answer on my question. Help me please. There are two servers:

serverA with public IP and an private IP
serverB with public IP

I have setup SOCKS proxy on serverB to serverA:

ssh -D20.0.0.11:2222 root@

So when on my local machine in a browser i specify SOCKS proxy (serverB:2222) as external IP while browsing i get (serverA IP). That is ok.

As well if i go onto (serverA private IP) it is also reachable. That is what i need. I want to make servers A private IP to be available through servers B public IP on certain ports but without specifying SOCKS in my browser.

I could use ssh port forward but the problem is - i need to forward many ports and do not know which exactly - i know only the range.

So when i connect to to any port , for example, from 3000:4000 range, i want that traffic to be redirected to on the same port. That is why i`ve decided maybe SOCKS proxy via SSH and iptables REDIRECT could help me.

Client -> serverBPublicIP (any port from range 3000:4000) -> serverAPublicIP -> serverAPrivateIP (the port was requested on serverBPublicIP)

On serverB i do:

ssh -D20.0.0.11:2222 root@
iptables -t nat -A PREROUTING -d -p tcp --dport 3000:4000 -j REDIRECT --to-port 2222

But that does not work - when i telnet on for example i do not see any proxied traffic on the serverA. What should i do else? I have tried tcpsocks like this (in example i am telneting to

Client -> -> iptables REDIRECT from 3001 --to-port 1111 -> tcpsocks from 1111 to 2222 -> SOCKS proxy from serverB to serverA on port 2222 -> serverA

But i do not know what to do with the traffic on serverA. How to route it to its private IP. Help me please. I know, VPN removes all the hell i am trying to create, but i have no ability to use tun/tap device. It is disabled.

share|improve this question
If you want help with your solution using tcpsocks, you're going to have to tell us how you're invoking tcpsocks. The documentation for tcpsocks at will probably be useful to you. – Per von Zweigbergk Dec 3 '11 at 3:24
@Radium: You first try (iptables redirect to 2222) will not work, because it only redirects TCP traffic and the clients to "speak socks", which 2222 will require. To see why your second try did not work, we need to see what you tried exactly (how did you use tcpsocks?) – Steffen Heil Apr 21 '13 at 11:32
Can you try with SSH and tun interfaces instead of socks? – LatinSuD Sep 10 '14 at 17:24

An alternative would be to do is to do something like:

ssh -L 3000: -L 3001: .... -L 4000:

This will set up a thousand and one seperate ssh tunnels for each port. I have never tried setting up over a thousand simultaneous ssh tunnels, so I have no idea what the performance is going to be like, or if it's even going to work at all, or if you're going to have to set up multiple parallell ssh processes.

It's going to be a pretty long command line, I would suggest writing some kind of script to actually invoke the command.

All in all I would not recommend this, if at all possible, set up a VPN.

Is there any reason your users can't just connect to directly? Or are the ports not exposed through the firewall? If not, can't you just open up the ports in the firewall from selected IP addresses, or do you have security considerations that don't let you do this?

share|improve this answer
Yeap, i was doing that with autossh -M 0 -nfR ... using the script. But it allows to forward only 100 ports a time. So i need to lunch seperate process for each 100 ports. If the are many ports i would eat all the RAM i have. The reasons are the same when i use VPN. The difference is i can`t use it :) – Radium Dec 3 '11 at 9:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.