Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a computer behind a firewall, a home desktop, and a server. I can reverse ssh tunnel to the server from computer_behind_firewall, and then

ssh  localhost -p some_port

while on the server, but it doesn't work if I try to

ssh my_server -p some_port

from home. I've disabled iptables to make sure it's not a firewall issue, and that hasn't helped.

What do I need to make my Ménage à trois of servers work out?

Ideally I'd like to port forward http on certain requests to the machine behind the firewall.

share|improve this question

migrated from Dec 25 '09 at 21:11

This question came from our site for professional and enthusiast programmers.

Sounds like a SuperUser question – Traveling Tech Guy Dec 24 '09 at 18:51
A picture of the network scenario would be worth 1k words. – pcapademic Dec 29 '09 at 22:30

From the SSH documentation on Port Forwarding:

It is important to realize that if you have three hosts, client, sshdserver, and appserver, and you forward the traffic coming to the client's port x to the appserver's port y, only the connection between the client and sshdserver will be secured. See Figure Forwarding to a third host. The command you use would be something like the following:

ssh2 -L x:appserver:y username@sshdserver

alt text

share|improve this answer

If you already have a reverse ssh tunnel with the server, you're probably looking for "-g" option.

-g      Allows remote hosts to connect to local forwarded ports.

Otherwise only localhost will be allowed to use your tunnel.

share|improve this answer

I don't quite get your question or rather, what the problem is and what you want to achieve. Also, this is not a coding question, but I'll try to dig into it.

Do you want to tunnel TCP connections through SSH to computer_behind_firewall through the server from outside the firewall? And this SSH connection to server fails? If so, you should run tcpdump tcp PORT on the server to see if really no packets arrive. If they arrive, your sshd or TCP wrapper are configured to not accept connections from outside (check /etc/ssh/sshd_config, /etc/hosts.deny and /etc/hosts.allow). Also look into the logfiles in /var/log. If no packets arrive, there is a firewall either at the sending end or on the gateway to the LAN of the server that is blocking or not forwarding into the private network.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.