I am trying to figure out SSH port forwarding and have not found success from looking at different questions and tutorials, it seems that everything I have seen is just a little different than my situation and I can't quite figure out how to apply it to mine.

I am running an application (A) from a Windows machine in an internal network (22.22.22.xx). This application must be hosted on this network. I also have a Linux SSH client/server (S) on a machine that has a network adapter card for the (22.22.22.xx) network as well as one for the (11.11.11.xx) network. I have an application client (C) running on Windows that has access to the SSH client but does not have access to the (22.22.22.xx) network therefore cannot access A directly. The set up is displayed below.

network setup diagram

I am trying to set up port forwarding from the SSH server so that the application client can reach the application server.

So far, I have been able to get local port forwarding working using PuTTY on the application client. I used this command (entered on PuTTY's UI):

ssh -L 8888: user@

From here I am able to go to localhost:8888 on 'C' and am tunneled through 'S' to reach the page being served on 'A'. However, in a perfect world, I would like to not have to open and run PuTTY on the client every time to access the page.

So, I am trying to find a way to set up remote port forwarding to forward a port, say 4444, on 'S' to 'A'. So that from 'C' I could simply go to and I am tunneled into

So far, I have tried running this on the command line in 'S':

ssh -R 4444: user@localhost -o GatewayPorts=yes

When I ran this, it looked like I ssh-ed right back into the machine, I entered the credentials and tried going to from the client and I was not directed to the server. I also tried running this command (but from PuTTY) on 'A':

ssh -R 4444:localhost:5555 user@ -o GatewayPorts=yes

From this I got a 'Remote port forwarding failed' message in the PuTTY event log.

I feel like I am very close to the solution and just have something confused in my commands or I am way off and don't understand what is going on at all.


You don't want a remote/reverse forwarding, although with the local version (your first example) there would be little difference, except it needs configuration on the server. The option GatewayPorts=yes is for the ssh server, not for the ssh client.

Try on the server S

ssh -g -L 4444: user@localhost
  • Hm that seems like it makes sense, but when I tried it, I ssh-ed back into the server S, entered the credentials, and when I tried to connect to from the client I got a connection timeout, running 'netstat -a -n' from the server S I see: ' - - ESTABLISHED', - - ESTABLISHED', and ':::4444 - ::: - LISTEN' – Jtt3mr Aug 22 '18 at 18:00
  • If you get a connection timeout and not connection refused, a firewall is blocking your connection. You could add the output from netstat to the question. – RalfFriedl Aug 22 '18 at 18:05
  • Would that be the firewall of the ssh server or of the application server? – Jtt3mr Aug 22 '18 at 18:10
  • On the SSH server, 'S'. The application server accepts connections on port 5555. – RalfFriedl Aug 22 '18 at 18:13
  • Running netstat -tuplen on the SSH server gives me: tcp -- -- -- LISTEN -- ssh So that would mean that the SSH process is listening on that port and not being blocked by firewall, correct? – Jtt3mr Aug 22 '18 at 18:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.