I'm not a server admin, but because of some Facebook Connect programming I'm doing, I need a public facing URL on port 80 to forward to my local development environment. So I have a Centos based web server, and I've stopped the httpd (and nginx) services, but when I try to SSH tunnel from port 80 it doesn't work. It works on any other port from what I can tell.

Here's basically the command I'm running:

ssh -v -p 22 -nNT4 -R *:80:localhost:3000 username@http://myurl.com

Is port 80 tied up somehow on the server? Do I have to release it or something? I looked around and saw that it might be related to the GatewayPorts setting in my sshd_config - that's set to "Yes" at the moment.

Thanks in advance for any advice!


  • 1
    a slightly better description of the machines involved and their roles would be helpful Aug 27, 2009 at 20:09
  • 1
    I assume it's just a typo, but 'username@myurl.com' is not a valid ssh connection string as far as I know.
    – davr
    Aug 27, 2009 at 20:57
  • If any of these worked for you (including mine), please consider marking it as accepted. This will help future people finding this know what worked for you. Alternately, if none of them did, add some details about what's going on now so we can help!
    – Bill Weiss
    Aug 30, 2009 at 18:52

3 Answers 3


As a normal (non-root) user, you can't bind to ports < 1024.


Use 'netstat -lnp|grep ":80" to see if anything is listening on port 80.

As Bill Weiss mentioned, you'll need to ssh to the remote box as root so that you have permission to bind to a port under 1024.

Additionally, you'll need GatewayPorts enabled in the sshd_config on the public-facing server. Without that, sshd will only allow it to bind to the loopback address.

GatewayPorts Specifies whether remote hosts are allowed to connect to ports forwarded for the client. By default, sshd binds remote port forwardings to the loopback address. This prevents other remote hosts from connecting to forwarded ports. GatewayPorts can be used to specify that sshd should allow remote port forwardings to bind to non-loopback addresses, thus allowing other hosts to con- nect. The argument may be no'' to force remote port forward- ings to be available to the local host only,yes'' to force remote port forwardings to bind to the wildcard address, or clientspecified'' to allow the client to select the address to which the forwarding is bound. The default isno''.

Also, 'http://www.myurl.com/' in your example should also just be the hostname (without the http://)


Can you run nc -l 80? If there is anything else using the port you should get "nc: Address already in use"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.