17

I have a SOURCE host which is remote and behind NAT. I want to connect to SOURCE via ssh from a TARGET host which is in my home network. Thus I issue the following command on SOURCE:

ssh -R 2222:localhost:22 TARGET -N

Now from TARGET I can connect to SOURCE via ssh -p 2222 localhost. Fine

With TABLET in the same network of TARGET I would expect this to work:

ssh -p 2222 TARGET

Instead it looks like TARGET only accept connections on port 2222 from localhost. The following is on TARGET:

user@TARGET:~/$ netstat -l | grep 2222
tcp        0      0 localhost:2222          *:*                     LISTEN     
tcp6       0      0 localhost:2222          [::]:*                  LISTEN 

Is there a way to make the remote side of a ssh -R accept connections from all its interfaces?

1 Answer 1

29

By default, it will listen on localhost (loopback interface) only. You need to specify the bind_address as 0.0.0.0 in your command:

ssh -R 0.0.0.0:2222:localhost:22 TARGET -N

You need also to configure SSH daemon on target host to allow client to specify the bind_address. It is prohibited by default to listen to all interfaces. So, you will always find it listening on loopback even if you specifiy 0.0.0.0 as bind_address.

You need to have a line like the following in /etc/ssh/sshd_config to allow client to specify the bind address.

GatewayPorts clientspecified

When done, you can verify using netstat -lntp on target machine.

7
  • Actually I already tried that, but with no success. Does this work for you? This is the output: tcp 0 0 127.0.0.1:2222 0.0.0.0:* LISTEN - - tcp6 0 0 ::1:2222 :::* LISTEN -
    – Jack
    Commented Jul 13, 2017 at 8:16
  • Anyway I thought that the HOST in PORT:HOST:PORT was referring from caller side
    – Jack
    Commented Jul 13, 2017 at 8:18
  • @Jack: Sorry, my answer was not complete. I updated it!
    – Khaled
    Commented Jul 13, 2017 at 8:49
  • Fantastic, I didn't know about the HOST:PORT:HOST:PORT syntax. Very useful. Also sshd configuration was missing. Thanks a lot
    – Jack
    Commented Jul 13, 2017 at 9:11
  • Actually 0.0.0.0 at the beginning of a parameter can be omitted. This is a shortcut. It means that -R :2222:localhost:22 will do the same. Please note and don't forget semicolon right before 2222. Commented Oct 23, 2020 at 14:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .