I have the following setup: One machine with sshd running (local) behind a router (router) and a second host (remote) tries to access local through the internet and the router via ssh.

Therefor: Port forwarding router:22 -> local:22 (and router as gateway for local) . Works perfectly fine.

If I try to create a ssh tunnel from remote to local as follows:

ssh -L 1234:R:12345 user@R 

this will only work if I also redirect router:1234 -> local:1234.

My understanding was, that ssh will tunnel all the traffic trough its connection on port 22. But it seems, that this is not the case. Am I doing something wrong? Is there any possibility to tunnel all the traffic through a single connection?


Your question was a little unclear to me, so I'm going to specify what I assumed and then try and help you with your problem. You are at the computer 'remote' which is SSH'ing to 'local' and this part works fine. If this is the case we no longer need to worry about router.

Continuing my assumptions, 'local' has a service running on it on port 12345 that you would like to access from 'remote' without opening additional ports on your router. What you would want to do is use the following command from 'remote':

ssh -L 1234:localhost:12345 user@router's_ip

To connect to the service you would then access it through localhost:1234.

The way the port forwarding syntax works is: {local_port}:{proxy_dest}:{proxy_port}

local_port is the port that will open on the client machine you are connecting from, to access it you would use localhost:local_port

proxy_dest is the host you would like to connect to from the perspective of the server you are SSH'ing into

proxy_port is the port on the remote system that you would like to connect to.


An answer to the second part of your question. You can use the dynamic proxy feature of later versions of SSH to forward all traffic with a couple of caveats.

The applications you are using on your client must support SOCKS proxies.

The OpenSSH only supports a SOCKS4 style proxy.

The syntax used is:

ssh -D user@remotehost


I think that you're wanting:

  • To ssh from remote to local
  • and forward port 1234 on remote to port 12345 on local

You seem to be indicating that local sits behind NAT happening on router - this would be why you need to set up the portforward so that router:22 forwards internally to local:22

If I've understood this correctly, the commandline you want to use on remote is actually:

ssh -L 1234:local:12345 user@router

The key here is that although this is a local portforward (-L == local) the resolution of the hostname (ie, local in this case - the second parameter in the 1234:local:12345 list) happens on the destination machine - which in this case is local.

In your example, you had 1234:router:12345 - which means that traffic goes down the ssh tunnel from remote to local; then is routed from local to router - and as you've said, this requires yet another portforward to get the traffic back to local.

An alternative would be to ssh from local to remote, using ssh -R 1234:local:12345. This wouldn't need the portforward on router, but you'd still have 1234 on remote forward to 12345 on local. The obvious downside to this is that you can't initiate this connection from remote, as you have no way of reaching local.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy