Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

My situation :

Me(localhost) -> Server A(ip: =>(server B(ip:,server....)

i'm able to SSH into server since it has a true ip if i then want to connect to server b, i would ssh server b with it's ip(


from my pc:

ssh user@

then in,

ssh user@

this would get me to server B with ssh

what if i want to connect to server b directly? how can i do that?


from my oc:


i have tried the following:

ssh -L 22:localhost:22 user@

without success

share|improve this question

4 Answers 4

up vote 11 down vote accepted

Your problem is in binding a listener to localhost:22; there's already an sshd listening on that. Tunnelling an ssh connection through an ssh connection is completely lawful, and I do it all the time, but you need to pick unused ports for your forwarding listeners.


me% ssh user@ -L 2201:


me% ssh localhost -p 2201

You should end up on server B (unless something's already bound to me:2201, in which case, pick another port).

share|improve this answer
thanks for the quick reply! it does work, however, how i can forward all connections instead of only ssh(22)? – tom91136 Dec 15 '11 at 12:00
That's a full-blown VPN you're looking for, not just port-forwarding. There's a writeup on how to do vpn-over-ssh at , but it requires remote root access via ssh on A. Or you could look into OpenVPN or other VPN solutions, but again, you'll need privilege on A to make these work. – MadHatter Dec 15 '11 at 12:06
thanks a lot, one last thing, what if i only want to connect to A? – tom91136 Dec 15 '11 at 12:12
me% ssh user@ ; didn't we already cover that? or do you mean "what if I want a full-blown VPN to A?", in which case my answer stands. – MadHatter Dec 15 '11 at 12:19
For people who want VPN over SSH, don't have root access on the server but it does have Python, try sshuttle. – André Paramés Dec 15 '11 at 15:50

I used a different solution. I used a ProxyCommand option (here in ~/.ssh/config):

Host myinsidehost1 myinsidehost2 myinsidehost3
ProxyCommand ssh externalhost ssh %h sshd -i

This doesn't set up any port-to-port tunnel, instead tunnels ssh by using standard stdin/out. This method has a drawback that there are actually three ssh connections to authenticate. But to connect to the internal host you just type:

ssh myinsidehost2 you do not need to care about choosing any IP for that tunnel.

share|improve this answer
This is the only kind of SSH stacking that I find working. I've been tried corkscrew or nc (netcat) but none work as seamlessly as this. – Phuong Nguyen Sep 16 '14 at 16:38

You don't have to use ssh port forwarding to ssh into an internal computer through a proxy. You can use the ssh feature of executing a command on the first server you connect to in order to ssh into a 3rd computer.

ssh -t user@ ssh user@

The -t option forces ssh to allocate a pseudo-tty so you can run an interactive command.

This can work with ssh keys as well. If you have your private and public key on machine A and your public key in the authorized keys files on machines B and C, then you can use the -A option to forward the authentication agent connection.

share|improve this answer

according to the ssh man page, ProxyCommand is the correct method

the syntax being:

ProxyCommand ssh -W %h:%p user@jumphost 2> /dev/null
share|improve this answer
I am not sure the -W option existed when this question was answered. But with newer versions of the ssh client, I agree that the combination of ProxyCommand and -W is the preferred method. Maybe add some context showing both how it can be used on the command line as well as an example of a section for .ssh/config. – kasperd Jul 21 at 8:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.