I have two physical servers in my home network, linux (192.168.8.x) and windows server 2008 (192.168.8.y).

The linux server ist accessible from outside by ssh on a non-standard port (say 23008). How do I establish a permanent RDP tunnel through ssh on the linux box? I know that I can use putty on the outside machine, but I don't know how to set up sshd on the linux box correctly. Thanks for any hints!

3 Answers 3


Assuming your linux box is accessible from the internet at on port 23008, on an external system I would do:

external% ssh -p 23008 -L 13389:192.168.8.y:3389 [email protected]

I'd then connect to the port-forwarded RDP system with

external% rdesktop localhost:13389

If your external box isn't a linux box, there will be equivalent commands for the tools you have; the idea is still the same: to forward external's port 13389 to 192.168.8.y's port 3389, then use external's RDP client to connect to localhost:13389.

You refer to setting up the linux box's sshd correctly, but unless you've reconfigured it, the standard sshd setup is likely to support this just fine.

  • You're right, I thought I have to configure sshd to tunnel specific ports. But this is all done with the client command. (ssh or putty on windows). I
    – elsni
    Dec 1, 2010 at 16:19
  • Excellent. In Microsoft Remote Desktop on my Mac, it worked just fine with the Connections/Edit PC/PC Name: as localhost:13389
    – Dave X
    Jan 2, 2021 at 20:44
  • Then is there a way for RDP to use the ssh credential that was established and not prompt for username and password in RDP?
    – Prab
    Apr 26, 2021 at 19:21
  • This works great for jump host! Also came across a similar gist that is helpful as well!
    – kyrlon
    Mar 19 at 1:09
ssh -L 3389:<ip of windows server>:3389 <ip of ssh server> -l <ssh user> -N

Assuming 3389 is the port your RDP is running on AND the ssh server has access to said port, you can then connect to as if it were the remote server.

  • is the ip of ssh server the internal or the external one? The external changes daily, but the server is accessible vie dyndns from outside
    – elsni
    Nov 29, 2010 at 11:13
  • IN which case: ssh -L 3389:<ip of windows server>:3389 <dydns of ssh server> -l <ssh user> -N hostnames can be used in place of ip's assuming of course you have port 22 forwarding onto the ssh server, which on a side note can be bad, if using a different port and forwarding that on i.e. 1212 use the -p 1212 flag.
    – Oneiroi
    Nov 29, 2010 at 12:25
  • <prdp> is rdp port on internal windows server <pssh> is port of public ssh linux server (nonstandard in my case) <ptunnel> is the port for the tunnel <ipwserver> is internal ip adress of windows server. I did a ssh -L<prdp>:<ipwserver>:<ptunnel> myserver.gotdns.com -l myusername -N -p <pssh> correct?
    – elsni
    Nov 30, 2010 at 15:47
  • 2
    In my case I got bind []:3389: Permission denied channel_setup_fwd_listener_tcpip: cannot listen to port: 3389 Could not request local forwarding. --------------> So what I did was use a different local port, eg 4444 as in ssh -L 4444:<server>:3389 <sshServer> -l <sshUser> -N Dec 20, 2022 at 16:46

One can use internal ssh tunneling from Remmina remote desktop client too.

If you can ssh to some linux server using ssh keys and that server have open 3389 (RDP) port for packets coming from your machine you can use following setup to RDP over ssh tunnel.

In profile editor setup the Basic tab as for direct connection. Go to SSH Tunnel tab and setup the tunelling like this:

[x] Enable SSH tunnel

(o) Custom [ip/hostname of ssh/linux server]

SSH Authentication:

User name: [username on the ssh/linux server]

(o) Public key (automatic)

Using those options Remmina opens

ssh -L 3389:[target windows server]:3389 [linux server] -N

and then connects the RDP session throug that ssh channel.

If you logon to the linux server using username/password or if you are using different identity file you have to change the SSH Authentication section of profile setup.

  • 2
    Brilliant. Was already using Remmina, did it the ssh -L way, then saw your answer, and now it's all baked in to one config in Remmina.
    – CivFan
    Jul 6, 2022 at 22:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .