Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I used the following command to create a tunnel from my system to server1 and from server1 to server2 to have a tunnel from my system to server2

ssh -t -t -L4450:localhost:5590 user1@server1 'ssh -L 5590:localhost:2000 user@server2'

But I get the following messages when I try to browse the web in my browser:

channel 3: open failed: connect failed: Connection refused
channel 4: open failed: connect failed: Connection refused

Is there anything wrong with the command?


My goal is to access internet via server2(SOCKS Proxy). Because of some limits, I have to use a interface server(server1) to create a tunnel to server2.

share|improve this question
One thing that could be wrong is that -L isn't the option normally used when one wants to "browse the web" over SSH, it is for establishing tunnels to a single explicit destination. What kind of program do you have running on server2 on port 2000? – grawity Dec 9 '11 at 7:58
@grawity I find this command by searching in google. I changed 2000 to 80. With 80, it doesn't show the message anymore, but I still cant browse the web. Firefox shows "Connecting to" and then says "Unable to connect" – hpn Dec 9 '11 at 8:04
Could you explain a bit more in your post -- for example, what were you trying to achieve in the first place? Browse the entire web via 'server2', or to access a single specific service? – grawity Dec 9 '11 at 8:10
@grawity I edited the post – hpn Dec 9 '11 at 8:45
Does server2 already have a SOCKS proxy running, or are you trying to create one using the tunnel? – grawity Dec 9 '11 at 9:13
up vote 1 down vote accepted

This should be the command:

ssh -t -L4450:localhost:5590 user1@server1 ssh -t -D5590 user@server2

The first ssh does a straight portforward of 4450 to server1, sending packets to its port 5590. The second establishes a connection to server2 with a dynamic portforward (socks proxy) listening on server1 port 5590.

So packets from you going to your localhost:4450 will get forwarded to server1 5590, which is the dynamic port forward sent to server2 and out to the internet from the server2 IP.

share|improve this answer
Thanks. but Firefox says: The proxy server is refusing connections. Why? – hpn Dec 9 '11 at 12:08
maybe related: debug1: Local forwarding listening on ::1 port 4450. – hpn Dec 9 '11 at 12:20
Can you do netstat -an | grep 4450 on the origin, and netstat -an | grep 5590 on server1? – Paul Dec 9 '11 at 12:50
Yes. both have results – hpn Dec 9 '11 at 13:08
Now it works. I don't know why it didn't work before. Thanks – hpn Dec 9 '11 at 13:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.