Can I ssh tunnel and reverse ssh tunnel in one connection?

Question

I am currently using .ssh/config to store my office's network:

Host office
    Hostname office.company.com
    Port 22222
    User hobbes3

To connect to a remote office Postgres database, I need to SSH to the office server then jump to the office database, so I use ssh tunneling like this

ssh -L 5433:db:5432 office

(I use port 5433 since I already have a local Postgres database installed on my machine)

(And db is the resolved hostname of the database server on the office network)

I also use Xdebug for PHP debugging so my local machine is listening on port 9000. Therefore I use a reverse ssh tunneling like this

ssh -R 9000:localhost:9000 office

But that means I need to have 2 terminals open and I tried to combine the two commands into one like this

ssh -L 5433:db:5432 -R 9000:localhost:9000 office

(I know I can use xdebug.remote_host to connect directly to my local machine's public IP, but I wanted to use tunneling so I can work at the office or at home under two different IPs)

but that only half worked (the -L tunnel worked, but the -R didn't).

Can I have both regular and reverse SSH tunneling in one command? And if so, what did I do wrong? Thanks in advance!

Answer 1

It's perfectly legal to use both straight and reverse port forwarding in the same tunnel. You can even multiply each option to setup multiple ports forwarding.

I'm sure your problem there is a bit different: you want to forward port 9000 that is for X connections and your approach most likely clashes with two more related security mechanisms: X-server's own authorization and SSH own X-forwarding control. If you only aim to run X apps through SSH client, then you don't need to tunnel X ports manually. Instead, configure both your SSH server and client to establish X-forwarding by this configuration:

1) On SSH server set line "X11Forwarding yes" in /etc/ssh/sshd_config (don't forget to restart sshd)

2) On client side either use explicit -X option for ssh or alternatively, add line "ForwardX11" in your .ssh/config for the connected host. The command would be just like that:

ssh -X -L 5433:db:5432 office

which must setup X forwarding by agreement between all the X control mechanisms.