ssh tunnel only works when logged in to proxying machine

Question

Ubuntu 18, Firewall not enabled, and I have configured sshd_config to allow forwarding and gateway :

AllowTcpForwarding yes
GatewayPorts yes 

If I create a tunnel listening on all ports:

ssh -f -N -L 222:0.0.0.0:22 [email protected]

This works fine if I am logged into that machine and connect using localhost:

ssh root@localhost -p 222

But when I connect to the proxying machine from another machine the connection fails:

ssh [email protected] -p 222
ssh: connect to host 192.168.0.20 port 222: Connection refused

What am I doing wrong ??

EDIT

# lsof -n -i:222
COMMAND  PID USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
ssh     4937 root    4u  IPv6 5877871      0t0  TCP [::1]:222 (LISTEN)
ssh     4937 root    5u  IPv4 5877872      0t0  TCP 127.0.0.1:222 (LISTEN)

Even if I kill the original process and create a new process and specify the IP address lsof still shows it only listening on localhost !

ssh -f -N -L 222:192.168.0.20:22 [email protected]

Answer 1

By default sshd binds forwarded ports to localhost only. One can overwrite this behavior either by using a wildcard or specify an address.

---

For use with wildcard, where :222::22 is equivalent to :222::22

user@client$ ssh -L :222::22 server

This will open a listener on client on port 222 on all interfaces which will be forwarded to server:22.

---

If you want to bind the listener and forwarded address, you can use the IP addresses or hostnames of the corresponding hosts.

user@client$ ssh -L client:222:localhost:22 server

This will open a listener on client:22 on the IP address that is resolved to client and will be forwarded on server to localhost:22.

---

Another option would be to use the GatewayPorts=yes option in the ssh command, which will also open a wildcard listener on client.

user@client$ ssh -o GatewayPorts=yes -L 222::22 server

One could also add this into the ~/.ssh/config file to make the setting permanent for a specific host.

Host server
    GatewayPorts yes