13

Using the command ssh -v -R 2255:localhost:2255 root@example.com I was trying to figure out why remote port forwarding wasn't working until I realized GatewayPorts yes was not present in my host's sshd_config. Once I added that, it worked successfully.

Is there a way I could have diagnosed this?

The SSH even output the following (without GatewayPorts yes): 

debug1: Remote connections from LOCALHOST:2255 forwarded to local address localhost:2255
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: pledge: network
debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
debug1: remote forward success for: listen 2255, connect localhost:2255
debug1: All remote forwarding requests processed
Improve this question
2
  • 1
    You can't diagnose everything from the client, you frequently need to check from the server (sometimes after increasing the verbosity to a sufficient debug level there as well)
    – HBruijn
    May 19, 2017 at 13:51
  • Surely there exists some means to verify that packets are being forwarded or not.
    – Chris Stryczynski
    May 19, 2017 at 14:09

7 Answers 7

Reset to default
10

You need GatewayPorts yes in sshd_config to be able to access it from outside.

Improve this answer
1
  • 1
    sudo systemctl restart ssh.service
    – CoderPi
    Jun 13, 2022 at 19:01
5

When you specify 2255:localhost:2255 fills the missing hostname in front as a localhost. This will really bind only to localhost address (loopback). If you want to use it also "from outside", you need to use the server IP for the remote port forwarding, such as example.com:2255:localhost:2255.

Improve this answer
9
  • I'm not too sure where I imply that I'd like to access this "from outside"?
    – Chris Stryczynski
    May 19, 2017 at 15:21
  • To localhost, you can connecton only from that machine (and not from any other). To the IP of that server, you can connect also from other machines in the network.
    – Jakuje
    May 19, 2017 at 15:22
  • It is not clear what you mean by "not working" in the question, but this could be the case.
    – Jakuje
    May 19, 2017 at 15:23
  • localhost is lo interface on example.com
    – Mikhail Khirgiy
    May 19, 2017 at 15:31
  • @MikhailKhirgiy yes. And so what?
    – Jakuje
    May 19, 2017 at 15:32
2

You can always add more -vs to make the output even more verbose. OpenSSH supports up to three vs:

ssh -vvv

Level three verbose output should include information about port forwarding.

Improve this answer
1

If I were to diagnose this today I'd probably have a look at tcpdump:

tcpdump -v -i any tcp port 2255 -A.

Improve this answer
1
  • 1
    Why this? I try and see gibberish...
    – jaromrax
    Mar 13, 2019 at 12:33
1

The correct answer for me were both the answers of Jakuje and noraj combind:

  1. You need to specify the remote bind address in addition to the remote port to -R (i.e. -R '*:$REMOTEPORT:$LOCALADDR:$LOCALPORT'). If you don't specify the address, sshd will only bind to the loopback interface (by default).

  2. By default, it seems, /etc/sshd_confing's GatewayPorts [defaults to no]. You should set it to yes to forcefully expose forwarded ports or clientspecified to allow the client to choose. I prefer the latter.

Once set, my server exposed the forwarded service as expected.

If you're still having trouble, you can check how sshd is actually binding the external port (e.g. ss -a) and whether the exposed port is being blocked by a local or upstream firewall.

Improve this answer
0

I'd do sudo netstat -a | grep 2255 and sshd -T It shows me now:

tcp        0      0 localhost:2255         *:*                     LISTEN

So it still binds to localhost even I did ssh -R server_ip:2255:localhost2255 server_ip.

sshd -T | grep -i gatewayports shows gateway ports set to no, which might be the reason.

Improve this answer
0

You have already added '-v' option to enable diagnostics. Now your ssh client will print something like this whenever a connection request is received and then forwarded,

debug1: client_input_channel_open: ctype forwarded-tcpip rchan 3 win 2097152 max 32768
debug1: client_request_forwarded_tcpip: listen localhost port 3311, originator 49.36.238.183 port 39234
debug1: connect_next: host 127.0.0.1 ([127.0.0.1]:3308) in progress, fd=7
debug1: channel 1: new [49.36.238.183]
debug1: confirm forwarded-tcpip
debug1: channel 1: connected to 127.0.0.1 port 3308
debug1: channel 1: free: 49.36.238.183, nchannels 2

And if the GatewayPorts is set to 'no' then the client will print nothing.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.