I have a SOURCE host which is remote and behind NAT. I want to connect to SOURCE via ssh from a TARGET host which is in my home network. Thus I issue the following command on SOURCE:

ssh -R 2222:localhost:22 TARGET -N

Now from TARGET I can connect to SOURCE via ssh -p 2222 localhost. Fine

With TABLET in the same network of TARGET I would expect this to work:

ssh -p 2222 TARGET

Instead it looks like TARGET only accept connections on port 2222 from localhost. The following is on TARGET:

user@TARGET:~/$ netstat -l | grep 2222
tcp        0      0 localhost:2222          *:*                     LISTEN     
tcp6       0      0 localhost:2222          [::]:*                  LISTEN 

Is there a way to make the remote side of a ssh -R accept connections from all its interfaces?

1 Answer 1


By default, it will listen on localhost (loopback interface) only. You need to specify the bind_address as in your command:

ssh -R TARGET -N

You need also to configure SSH daemon on target host to allow client to specify the bind_address. It is prohibited by default to listen to all interfaces. So, you will always find it listening on loopback even if you specifiy as bind_address.

You need to have a line like the following in /etc/ssh/sshd_config to allow client to specify the bind address.

GatewayPorts clientspecified

When done, you can verify using netstat -lntp on target machine.

  • Actually I already tried that, but with no success. Does this work for you? This is the output: tcp 0 0* LISTEN - - tcp6 0 0 ::1:2222 :::* LISTEN -
    – Jack
    Jul 13, 2017 at 8:16
  • Anyway I thought that the HOST in PORT:HOST:PORT was referring from caller side
    – Jack
    Jul 13, 2017 at 8:18
  • @Jack: Sorry, my answer was not complete. I updated it!
    – Khaled
    Jul 13, 2017 at 8:49
  • Fantastic, I didn't know about the HOST:PORT:HOST:PORT syntax. Very useful. Also sshd configuration was missing. Thanks a lot
    – Jack
    Jul 13, 2017 at 9:11
  • Actually at the beginning of a parameter can be omitted. This is a shortcut. It means that -R :2222:localhost:22 will do the same. Please note and don't forget semicolon right before 2222. Oct 23, 2020 at 14:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.