I have a remote Linux computer connecting on a local ssh server, creating a reverse ssh tunnel on port 5051. On the ssh server itself I run the following two commands, in order to give the remote computer a local IP address.

ip addr add dev eth0
iptables -t nat -A PREROUTING -d -p tcp --dport 22 -j REDIRECT --to-port 5051

On the ssh server I have also configured GatewayPorts yes in sshd_conf.

From a third computer on my network if I ssh on, I connect directly on the remote Linux computer.

But from the ssh server if I ssh I connect on the ssh server again. I don't connect on the remote computer. The only way to connect on the remote computer from the ssh server is to use ssh root@localhost -p 5051

But I don't want to do that. I want to be able to ssh from the ssh server, and connect on the remote computer.

1 Answer 1


IPTables NAT table's PREROUTING chain rules are only applied to IP packets arriving from other systems via the network adapter connected to the network.

If you want to apply a rule to locally generated packets, you need to add a rule to the OUTPUT chain.

So, you need to do this:

iptables -t nat -A OUTPUT -d -p tcp --dport 22 -j REDIRECT --to-port 5051

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .