Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am using a reverse SSH tunnel to expose a webserver within my network to the internet.
The “inside server” is behind a firewall within a network. The “outside server” is an Ubuntu server with a static IP address. The outside server has GatewayPorts enabled in the /etc/ssh/sshd_config file. From the inside server I run this command:

 ssh -p22 outsideuser@<<outside domain>> -f -i /root/.ssh/id_rsa -R 45000:localhost:80 /home/user/ $port

After I run this script I can open a terminal on the outside server and run netstat -nat and see this:

 Active Internet connections (servers and established)
 Proto Recv-Q Send-Q Local Address           Foreign Address         State
 tcp        0      0 *               LISTEN
 tcp        0      0 *               LISTEN
 tcp        0      0    *               LISTEN
 tcp        0      0    *               LISTEN
 tcp        0      0  *               LISTEN
 tcp        0    284 <<outsideip>>:22        <<insideip>>:58313     ESTABLISHED
 tcp        0      0 <<outsideip>>:80        <<insideip>>:46478     TIME_WAIT
 tcp        0      0 <<outsideip>>:22        <<insideip>>:35630     ESTABLISHED
 tcp6       0      0 :::45000                :::*                    LISTEN
 tcp6       0      0 :::22                   :::*                    LISTEN

I can then go to:


... and it successfully loads the web content at:

 http://<<insideip>>/ (port 80)

The only issue is that it stops working after that initial request. When I run netstat -nat again on the outside server this line is now missing from the output:

 tcp        0      0 *               LISTEN

I am able to telnet to port 45000 multiple times without breaking the connection. So it seems to be something related to making the request from a browser. Also, it seems that I can wget the over this connection as many times as I want but the first time I access it with a browser it breaks the connection.

I’ve been pulling my hair out trying to figure out what I'm doing wrong. Any ideas?

share|improve this question
Can you start the ssh tunnel with verbose mode enabled (-v/-vv/-vvv option) and share the output after the disconnection appear? – dsmsk80 Sep 6 '13 at 5:55
@dsumsky, I'm sorry I neglected to mention that the inside server is using dropbear ssh client. It doesn't seem to have a verbose option. – user548971 Sep 6 '13 at 6:12
I would try a different client ideally from OpenSSH project to verify whether the issue is network configuration related or whether it is a kind of incompatibility between OpenSSH server and dropbear client. Is this possible? – dsmsk80 Sep 6 '13 at 6:32
Ok, I was able to confirm that the exact same command from an OpenSSH client worked fine. So, the question is why does the dropbear client close the connection. Unfortunately, it isn't an option for me to switch. – user548971 Sep 6 '13 at 8:25
I have now tested enabling and disabling all dropbear features with no luck. :-( – user548971 Sep 6 '13 at 16:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.