Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


  • Let's call my machine macbook.
  • I have a server on tah interwebs. Call it server.
  • I have a Mac Mini elsewhere that I can access via iChat screen sharing. Let's call it mini.


  • server can see neither macbook nor mini.
  • macbook can see server but not mini.
  • mini can see server, but not macbook.

Screen sharing is slow. I want an SSH connection to mini. A direct connection is impossible because of routers, NAT, etc.

What I want to do is to connect both macbook and mini to server via SSH, creating the approriate tunnels, so that from macbook I can run a ssh … command to connect to mini by tunneling the connection through server.

So my question is, what commands do I have to run, on which machines, to make this work?

To keep it simple, please use server, mini, macbook as hostnames in your answers.

share|improve this question
you could short circuit that by setting up ipv6 on both machines gogo6 is one option - its a little work, but it'll end up easier on the long run – Journeyman Geek Aug 2 '10 at 10:19
Yeah that would be awesome but I don't even know where to start. Care to post an answer? – kch Aug 2 '10 at 11:30
up vote 6 down vote accepted

Only one ssh tunnel is needed. From the mini:

ssh -N -R serverUser@server

Now you can just connect from macbook onto server with ssh -p 8022 miniUser@server

Be sure to have GatewayPorts set to yes in the server's /etc/ssh/sshd_config.

Additionally you may want to define some stuff in ~/.ssh/config:

    HostName server
    Port 8022
    HostKeyAlias mini

This allows you to do the more coherent ssh, and at the same time not be bothered with server fingerprint mismatches.

share|improve this answer
This sounds awesome, but I'm getting an error when trying to connect from macbook: ssh: connect to host MyActualServer port 8022: Connection refused – kch Aug 6 '10 at 14:51
Could this be to blame? "Specifying a remote bind_address will only succeed if the server's GatewayPorts option is enabled (see sshd_config(5))." – kch Aug 6 '10 at 14:53
Ok, that was it, I was able to get it to work by setting GatewayPorts to yes in /etc/ssh/sshd_config. Can you please update your answer with this pesky detail? – kch Aug 6 '10 at 14:56
Answer edited. Thanks for the addendum. – Lloeki Aug 6 '10 at 15:20

On the Mac Mini do:

ssh -R 1234:localhost:22 serverUser@server

This will forward connections to port 1234 of the server to port 22 on the Mac Mini.

Then, on the MacBook do:

ssh -L 1235:localhost:1234 serverUser@server

This will forward connections to port 1235 on the MacBook to port 1234 on the server (which will then get forwarded to the Mac Mini by the above command).

Finally, to get your actual connection, on the MacBook do:

ssh -p 1235 miniUser@localhost

Which connects to port 1235 on the MacBook, which gets forwarded to port 1234 on the server, which gets forwarded to port 22 on the Mac Mini. Ports 1234 and 1235 can be set to more or less whatever you like - and can be the same (I used different numbers to make the explanation more clear). Similarly, port 22 should be changed if SSH on your Mac Mini is listening on a different port.

share|improve this answer
Awesome. Short and to the point. – kch Aug 2 '10 at 11:11
So, I fixed your commands and posted a new answer because I don't have rep to edit your answer directly. If you please do this edit I'll gladly accept your answer and remove mine. – kch Aug 2 '10 at 11:30
My apologies. I'm always forgetting to add the server in when I do port forwarding. I end up searching through my terminal history and finding the command from when I last used it - far easier than actually learning them. ;-) Does the third command in your answer actually work? By my understanding that would attempt to connect to mini directly rather than going through the tunnel. – Scott Aug 2 '10 at 12:45
oops, I meant localhost there. – kch Aug 2 '10 at 13:11
Why are you omitting the -N option? Not that it's necessary, but do you not prefer it? – kch Aug 2 '10 at 13:13

You can tunnel any command through an ssh session. That means you can also tunnel a ssh command through ssh.

This would look like this:

ssh -t userOnServer@url.of.server ssh

This opens an ssh session to server and from there instantly opens a second ssh session to mini. With an ssh tunnel this should work without problems from your macbook machine. At least given that mini is reachable from server.


  • ssh on macbook
  • ssh server and ssh client on server
  • ssh server and ssh client on mini

It might be nifty to make an alias so you don't have to type this every time you want to connect. Also think about password less connection to server so you don't have to enter 2 passwords for this tunneled connection.

share|improve this answer
server can't see mini. – kch Aug 2 '10 at 7:56
updated question with reachability details. sucks that you put so much effort into a great answer that's however useless :P – kch Aug 2 '10 at 8:06
Never mind that :) – fgysin Sep 2 '10 at 8:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .