I have a remote machine remotePi which uses autossh to maintain a reverse tunnel to a local machine localPi. When SSH'd into localPi, I can reliably ssh into the remotePi using localhost:3333.

Now I have a desktop Windows machine localWin with a browser which I would like to proxy through to the LAN of remotePi to access local HTTP resources.

So far, using Putty, I have been unable to achieve this. I understand how to do this with a single hop, but the second hop eluding me. Is this possible directly from Putty, or is there some additional ssh command I need to issue manually?


In Putty Tunnels configuration for the localPi:3333, pick tunnel type Dynamic (instead of Local or Remote). Enter source port 3334, leave empty tunnel destination. The final string should read D3334.

Now configure your Windows browser to use SOCKS proxy at localhost:3334.

SOCKS protocol means that even if a Windows browser will send TCP traffic to one IP, the browser includes "inside" the TCP traffic the target IP address. The Dynamic tunnel is SOCKS-compatible, so the tunnel decodes the target IP and instructs your remotePi to connect to target IP on your behalf.

Your communication with localPi:3333 doesn't talk at all to localPi's sshd. It only does 3333 tunneling. The 3334 tunneling is between localWin's putty and remotePi's sshd.

  • Thank you for the excellent answer. I had already come very close, but your answer spurred me to find the final piece of the puzzle: adding GatewayPorts yes to /etc/ssh/sshd_config.
    – Hamish
    Jan 16 '17 at 8:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.