Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I used the following command to create a tunnel from my system to server1 and from server1 to server2 to have a tunnel from my system to server2

ssh -t -t -L4450:localhost:5590 user1@server1 'ssh -L 5590:localhost:2000 user@server2'

But I get the following messages when I try to browse the web in my browser:

channel 3: open failed: connect failed: Connection refused
channel 4: open failed: connect failed: Connection refused

Is there anything wrong with the command?


My goal is to access internet via server2(SOCKS Proxy). Because of some limits, I have to use a interface server(server1) to create a tunnel to server2.

share|improve this question
One thing that could be wrong is that -L isn't the option normally used when one wants to "browse the web" over SSH, it is for establishing tunnels to a single explicit destination. What kind of program do you have running on server2 on port 2000? – grawity Dec 9 '11 at 7:58
@grawity I find this command by searching in google. I changed 2000 to 80. With 80, it doesn't show the message anymore, but I still cant browse the web. Firefox shows "Connecting to" and then says "Unable to connect" – hpn Dec 9 '11 at 8:04
Could you explain a bit more in your post -- for example, what were you trying to achieve in the first place? Browse the entire web via 'server2', or to access a single specific service? – grawity Dec 9 '11 at 8:10
@grawity I edited the post – hpn Dec 9 '11 at 8:45
Does server2 already have a SOCKS proxy running, or are you trying to create one using the tunnel? – grawity Dec 9 '11 at 9:13
up vote 1 down vote accepted

This should be the command:

ssh -t -L4450:localhost:5590 user1@server1 ssh -t -D5590 user@server2

The first ssh does a straight portforward of 4450 to server1, sending packets to its port 5590. The second establishes a connection to server2 with a dynamic portforward (socks proxy) listening on server1 port 5590.

So packets from you going to your localhost:4450 will get forwarded to server1 5590, which is the dynamic port forward sent to server2 and out to the internet from the server2 IP.

share|improve this answer
Thanks. but Firefox says: The proxy server is refusing connections. Why? – hpn Dec 9 '11 at 12:08
maybe related: debug1: Local forwarding listening on ::1 port 4450. – hpn Dec 9 '11 at 12:20
Can you do netstat -an | grep 4450 on the origin, and netstat -an | grep 5590 on server1? – Paul Dec 9 '11 at 12:50
Yes. both have results – hpn Dec 9 '11 at 13:08
Now it works. I don't know why it didn't work before. Thanks – hpn Dec 9 '11 at 13:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .