Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So unfortunately I live in a place that will not let me have a static IP, so I have been setting up access to my home computer via reverse SSH tunnels that run on an micro amazon ec2 instance. I have gotten SSH to work fine, but I cannot figure out port forwards.

Here is a small infographic I made to help illustrate (i felt the question was clearer with a diagram of what I was trying to do.

Here are the commands listed in the graphic:

I the following on my home computer:

ssh -R 1337:localhost:22 -i .ssh/tokyoMinekey.pem ec2-user@ec2serveraddress

and I run this on the ec2 server:

ssh -L6600:localhost:6600 -Nf localhost -p 1337

diagram of my paint AHHHHHH YEAHHHHHH!

FYI, I have added port 6600 into my security group for amazon ec2, so its open on the ec2 side

share|improve this question
I have a similar setup (I think) that allows me to connect to my mac at home via VNC... I use a server in the middle and push everything through ssh. Office Win7 machine tunnels into the server and the home MacOS machine tunnels into the server, then on the office Win7 machine I launch a VNC client and connect to localhost:customport... maybe the tunnel on your EC2 instance should actually be initiated by your client? – baraboom Jun 28 '11 at 14:00
up vote 2 down vote accepted

I'm not sure why you are using two separate ssh commands here? If you want to forward port 6600 on the EC2 instead to port 6600 on the machine at home then all you should need to do is:

ssh -R :6600:localhost:6600 -i .ssh/tokyoMinekey.pem ec2-user@ec2serveraddress

You will also need to make sure that the GatewayPorts option is enabled in the sshd_config file on the EC2 instance.

Obviously you will need to leave that ssh connection open for the port forward to continue working but other than that there shouldn't be any problems.

share|improve this answer
I got it working! – Hortinstein Jun 29 '11 at 10:30

Could you please provide the output of:

netstat -tulpen

on ec2serveraddress. I expect to see that both tunnels are starting at is the IP of the local machine itself, not accessible from outside. That means you can access this tunnel from the server itself but not from any other machine...

If this is the case, please add the following to your /etc/ssh/sshd_config:

GatewayPorts yes

This option will create the ports at, so you can connect from everywhere. If there are no other reasons for creating two connected tunnels you can of course shrink it to only one:

ssh -R 6600:localhost:22 -i .ssh/tokyoMinekey.pem ec2-user@ec2serveraddress

This will create a tunnel ec2serveraddress:6600 to your home:22.

share|improve this answer is what happens when I type "netstat -tulpen" on ec2 after running: "ssh -R :6600:localhost:6600 -i .ssh/tokyoMinekey.pem ec2-user@ec2serveraddress on my home machine" – Hortinstein Jun 29 '11 at 10:11
woots got it working thanks for your help – Hortinstein Jun 29 '11 at 10:30
Why does your simple ssh call use no proceeding colon on ssh -R 6600:localhost:22 ..., when the answer from @TomH has one? (ssh -R :6600:localhost:22 ...? Is there any difrerence? – Bryan P Oct 24 '14 at 18:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.