I have a SOURCE host which is remote and behind NAT. I want to connect to SOURCE via ssh from a TARGET host which is in my home network. Thus I issue the following command on SOURCE:

ssh -R 2222:localhost:22 TARGET -N

Now from TARGET I can connect to SOURCE via ssh -p 2222 localhost. Fine

With TABLET in the same network of TARGET I would expect this to work:

ssh -p 2222 TARGET

Instead it looks like TARGET only accept connections on port 2222 from localhost. The following is on TARGET:

user@TARGET:~/$ netstat -l | grep 2222
tcp        0      0 localhost:2222          *:*                     LISTEN     
tcp6       0      0 localhost:2222          [::]:*                  LISTEN 

Is there a way to make the remote side of a ssh -R accept connections from all its interfaces?


By default, it will listen on localhost (loopback interface) only. You need to specify the bind_address as in your command:

ssh -R TARGET -N

You need also to configure SSH daemon on target host to allow client to specify the bind_address. It is prohibited by default to listen to all interfaces. So, you will always find it listening on loopback even if you specifiy as bind_address.

You need to have a line like the following in /etc/ssh/sshd_config to allow client to specify the bind address.

GatewayPorts clientspecified

When done, you can verify using netstat -lntp on target machine.

  • Actually I already tried that, but with no success. Does this work for you? This is the output: tcp 0 0* LISTEN - - tcp6 0 0 ::1:2222 :::* LISTEN - – Jack Jul 13 '17 at 8:16
  • Anyway I thought that the HOST in PORT:HOST:PORT was referring from caller side – Jack Jul 13 '17 at 8:18
  • @Jack: Sorry, my answer was not complete. I updated it! – Khaled Jul 13 '17 at 8:49
  • Fantastic, I didn't know about the HOST:PORT:HOST:PORT syntax. Very useful. Also sshd configuration was missing. Thanks a lot – Jack Jul 13 '17 at 9:11
  • Actually at the beginning of a parameter can be omitted. This is a shortcut. It means that -R :2222:localhost:22 will do the same. Please note and don't forget semicolon right before 2222. – Victor Yarema Oct 23 '20 at 14:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.