I need a SSH tunnel from my home to private IP as diagrammed here:

+-------+    +-----------------+  +------------+  +-------------+
|       |    |                 |  |            |  |             |
| Home  +----+ foo.example.com +--+ +--+ |
|       |    |                 |  |            |  |             |
+-------+    +-----------------+  +------------+  +-------------+

I have root access on and I have zero access to foo.example.com. When I ssh to foo.example.com, I somehow land on, which is a different host. We're talking about 4 separate hosts. I assume foo.example.com uses one-to-one NAT.

I tried:

ssh -L 8080: user@foo.example.com

No luck. Any tips?

Edit: It turns out the tunnel works, but not for websockets. Connections to ws://localhost:8080 fail with this:

<snip> WebSocket connection to 'ws://localhost:8080/' failed: Error during WebSocket handshake: Unexpected response code: 200

I didn't realize this at first. I thought the connection just hung.

Edit 2: My apologies, but I figured this out. I didn't realize that the app involves 2 servers: nginx on port 80 and a websocket server on port 8080. I created 2 separate SSH tunnels, and all works now. I got confused because the local port I chose, 8080, was also the port used by the remote websocket server.

Summary: nothing special is required to create a SSH tunnel through one-to-one NAT.

  • What do you mean by "No luck"? Be specific. Show error messages and log entries. Sep 13 '20 at 4:42
  • @MichaelHampton After creating the tunnel as described, I tried curl http://localhost:8080 and the connection never was made. curl just hung. However, I figured it out. I'll post a solution very soon.
    – royco
    Sep 13 '20 at 4:49

Provided that can access I don't see why your ssh -L 8080: user@foo.example.com wouldn't work.

Can you telnet/curl from If not, maybe a firewall is configured on forbidding access to port 80, by dropping the connection and not rejecting it.


You may be able to use the ProxyJump feature in OpenSSH to do this cleanly.

ssh -J user@foo.example.com -L 8080:localhost:80 user@

Adding -J user@foo.example.com tells ssh to connect to the destination via port forwarding set up dynamically on foo.example.com. If you don't have ssh keys set up, you'll be prompted for passwords for both foo.example.com and

If this works for you, you can add it to your local ~/.ssh/ssh_config to make it easier. E.g.,

    ProxyJump user@foo.example.com

Then you won't need to specify the -J on the command line to connect to


Is there an option to use sshuttle? - https://github.com/sshuttle/sshuttle

It may be a simpler proxy option, especially given the lack of access to the remote SSH target.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.