Let's assume the following hosts:

localhost : my laptop 
remoteserver : a server with a public IP which runs a SSH server on port 22. (remoteserver ip for example 
private.remoteserver ssh on port 2255: a server with a private IP which is only accessible from remoteserver. (private.remoteserver ip for example


I want to create ssh tunnel that I can connect to private.remoteserver from my laptop threw remoteserver

I tryed this

ssh -L 2255: admin@

and then from laptop

ssh localhost:2255

but does not work. What I am doing wrong?


The easiest to do what is called "multi hop ssh" and connect from host A via host B to host C is with the ProxyJump command switch -J available in newer ssh versions:

 ssh -J userB@hostB:portB userC@hostC:portC

where the port numbers are only needed when a port number different from the default ssh port 22, is used.

Or with scp

 scp -o 'ProxyJump userB@hostB' localfile userC@hostC:/remote/path/
  • Thank you but I am getting this error now: channel 0: open failed: administratively prohibited: open failed stdio forwarding failed ssh_exchange_identification: Connection closed by remote host – senzacionale Dec 20 '18 at 9:20
  • To debug add one or more -v flags and check the server logs first on hostB and then on hostC for possible causes of your error message. - What I suggested may be impossible when the intermediate server hostB is configured with for instance PermitOpen none – HBruijn Dec 20 '18 at 9:30
  • Thank you. Looks like that i can not specify port 2255 debug1: channel_connect_stdio_fwd xxx:2255:22 debug1: channel 0: new [stdio-forward] debug1: getpeername failed: Bad file descriptor debug1: Requesting no-more-sessions@openssh.com debug1: Entering interactive session. debug1: pledge: network debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0 channel 0: open failed: administratively prohibited: open failed – mbrc Dec 20 '18 at 9:48
  • I add -p now for port but does not ask me for password .... – mbrc Dec 20 '18 at 9:51

You can put this in your ~/.ssh/config

Host <internal.ips>
    Proxycommand ssh -C -W %h:%p -q -A <public server ip>

just make sure internal.ips are accessible from the public server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.