Ubuntu 18, Firewall not enabled, and I have configured sshd_config to allow forwarding and gateway :

AllowTcpForwarding yes
GatewayPorts yes 

If I create a tunnel listening on all ports:

ssh -f -N -L 222: root@example.com

This works fine if I am logged into that machine and connect using localhost:

ssh root@localhost -p 222

But when I connect to the proxying machine from another machine the connection fails:

ssh root@ -p 222
ssh: connect to host port 222: Connection refused

What am I doing wrong ??


# lsof -n -i:222
ssh     4937 root    4u  IPv6 5877871      0t0  TCP [::1]:222 (LISTEN)
ssh     4937 root    5u  IPv4 5877872      0t0  TCP (LISTEN)

Even if I kill the original process and create a new process and specify the IP address lsof still shows it only listening on localhost !

ssh -f -N -L 222: root@example.com
  • What is the output of lsof -n -i:222 on the host where it is working? Add that to your question. – Thomas May 11 '19 at 10:15
  • Thanks, well it looks like it is only listening on localhost despite using ?! – crankshaft May 11 '19 at 10:21
  • Interesting even entering the IP address, and it is still only listening on localhost: ssh -f -N -L 222: root@example.com – crankshaft May 11 '19 at 10:23
  • You should then use ...-L *:222:*:22.... The port 222 will be opened on the SSH client where you issued the ssh command. This port will then be forwarded to the server you are logging into to the port that you specifiy *:22. – Thomas May 11 '19 at 10:33
  • Thomas, thanks, yes that works, would you like to add an answer and I will accept it ? – crankshaft May 11 '19 at 10:36

By default sshd binds forwarded ports to localhost only. One can overwrite this behavior either by using a wildcard or specify an address.

For use with wildcard, where :222::22 is equivalent to :222::22

user@client$ ssh -L :222::22 server

This will open a listener on client on port 222 on all interfaces which will be forwarded to server:22.

If you want to bind the listener and forwarded address, you can use the IP addresses or hostnames of the corresponding hosts.

user@client$ ssh -L client:222:localhost:22 server

This will open a listener on client:22 on the IP address that is resolved to client and will be forwarded on server to localhost:22.

Another option would be to use the GatewayPorts=yes option in the ssh command, which will also open a wildcard listener on client.

user@client$ ssh -o GatewayPorts=yes -L 222::22 server

One could also add this into the ~/.ssh/config file to make the setting permanent for a specific host.

Host server
    GatewayPorts yes
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.