I have a remote Linux computer connecting on a local ssh server, creating a reverse ssh tunnel on port 5051. On the ssh server itself I run the following two commands, in order to give the remote computer a local IP address.

ip addr add dev eth0
iptables -t nat -A PREROUTING -d -p tcp --dport 22 -j REDIRECT --to-port 5051

On the ssh server I have also configured GatewayPorts yes in sshd_conf.

From a third computer on my network if I ssh on, I connect directly on the remote Linux computer.

But from the ssh server if I ssh I connect on the ssh server again. I don't connect on the remote computer. The only way to connect on the remote computer from the ssh server is to use ssh root@localhost -p 5051

But I don't want to do that. I want to be able to ssh from the ssh server, and connect on the remote computer.

1 Answer 1


IPTables NAT table's PREROUTING chain rules are only applied to IP packets arriving from other systems via the network adapter connected to the network.

If you want to apply a rule to locally generated packets, you need to add a rule to the OUTPUT chain.

So, you need to do this:

iptables -t nat -A OUTPUT -d -p tcp --dport 22 -j REDIRECT --to-port 5051

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.