Port 9999 on a remote server needs to be accessed through an SSH tunnel at local port 9990 to avoid firewalls.

I am using this command to SSH tunnel:

ssh -N -i share.pem -L 9990:`ecshare`:9999 ubuntu@`ecshare`

where ecmy contains the ec2 instance's ip. As a baseline, I can ssh and get a remote shell with this command:

ssh -i share.pem ubuntu@`ecshare`

But, when I try this on the local prompt:

curl -i -X GET http://localhost:9990

I get this on the shell where the tunnel was started:

channel 2: open failed: connect failed: Connection refused

When I try this command on the remote shell:

curl -i -X GET http://localhost:9999

... I get a response from the server.

Why is connection being refused?


Despite the authentication method used, SSH tunneling works the same way. The problem here is not about using public key authentication but understanding the basics of How to Use SSH Tunneling.

Your -L 9990:example.com:9999 connects to the public network interface on the remote side while you connect to localhost:9999 in your curl test. The firewall you mentioned you need to avoid is probably on the remote side, preventing you to use http://example.com:9999/ in the first place.

You should use -L 9990:localhost:9999 instead to make it use local loopback.

Difference between <code>example.com</code> and <code>localhost</code> on the remote side.

This diagram visualizes your situation. The -L [ bind_address:]port:host:hostport...

...works by allocating a socket to listen to port on the local side, optionally bound to the specified bind_address. Whenever a connection is made to this port, the connection is forwarded over the secure channel, and a connection is made to host port hostport from the remote machine.

| improve this answer | |
  • The localhost:9999 is available on the remote server. Won't the command you gave look for it on the local machine? I need to connect to a local port to avoid firewalls. – fodon Apr 4 '17 at 17:09
  • "-L [ bind_address:]port:host:hostport Specifies that the given port on the local (client) host is to be forwarded to the given host and port on the remote side." That's exactly what it does; that part of the connection is on the remote end of the tunnel. – Esa Jokinen Apr 4 '17 at 17:22
  • So, since the server I want to access is on ecshare:9999, and I want to see it on localhost:9990, the command I set up i.e ssh -N -i share.pem -L 9990:ecshare:9999 ubuntu@ecshare ... is right? – fodon Apr 4 '17 at 22:25
  • Does curl -i -X GET http://ecshare:9999 work on the remote server? As you connected to localhost:9999 with curl, you can certainly also use it in -L. Based on the details on your original question, everything else seemed ok but the service on the remote server might only be available on local loopback interface. Have you actually tested my suggestion rather than speculated whether the man page has correct information? – Esa Jokinen Apr 5 '17 at 5:22
  • Thanks for the graphics and the effort ! I appreciate very much. This worked for me ! – fodon Apr 7 '17 at 20:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.