Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Well refering back to this question i am running the command ssh -R 8080:localhost:80 -N root@website.com on mac. Yet the port that is being tunneled is not working publicly. I am running such a command to make it so that the local port can be opened on the remote computer. And it does work when opening the port on localhost on the remote computer, but when i try to acess the public ip adress of the remote computer from my local computer the port doesnt seem to be open. How would i make the tunnel public on the ip for anyone to access?

EDIT: It seems as if the remote side only binds on localhost instead of to all interfaces.

EDIT 2: The client is Mac OS X 10.6 and the server is Linux Mint but their both OpenSSH

share|improve this question
    
What does public IP mean? If you are trying to connect to a local computer thru the router and via the Internet, most routers will not allow such loopback. –  harrymc Apr 30 '13 at 5:53

4 Answers 4

up vote 26 down vote accepted
+50

If you check the man page for ssh, you'll find that the syntax for -R reads:

-R [bind_address:]port:host:hostport

When bind_address is omitted (as in your example), the port is bound on the loopback interface only. In order to make it bind to all interfaces, use

ssh -R \*:8080:localhost:80 -N root@website.com

or

ssh -R 0.0.0.0:8080:localhost:80 -N root@website.com

or

ssh -R [::]:8080:localhost:80 -N root@website.com

The first version binds to all interfaces individually. The second version creates a general IPv4-only bind which means that the port is accessible on all interfaces via IPv4. the third version is probably technically equivalent to the first, but again it only creates a single bind to ::, which means that the port is accessible via IPv6 natively and via IPv4 through IPv4-mapped IPv6 addresses (doesn't work on Windows, OpenBSD).

Note that if you use OpenSSH sshd server, the server's GatewayPorts option needs to be enabled (set to yes or clientspecified) for this to work (check file /etc/ssh/sshd_config on the server). Otherwise (default value for this option is no), the server will always force port bound on the loopback interface only.

share|improve this answer
    
OH MY GOD IT WORKED!!!!! I have done exactly that 1 million times!! I just forgot that * in bash will give files and i needed \* –  Trevor Rudolph May 6 '13 at 7:08
    
I feel so dumb right now! But thank you! –  Trevor Rudolph May 6 '13 at 7:09
    
Yeah, that's exactly why I always prefer 0.0.0.0 - it's IPv4 only, but it'll do most of the time :) –  Stefan Seidel May 6 '13 at 7:51
    
fe80::1 hahaha –  Trevor Rudolph May 6 '13 at 7:54
    
jk :D yea but 0.0.0.0 is good, but can you use 127.0.0.1? or is that too local and nonbinding –  Trevor Rudolph May 6 '13 at 7:55

Edit:

-g works for local forwarded ports, but what you want is a reverse/remote forwarded port, which is different.

What you want is this.

Essentially, on website.com, set GatewayPorts=clientspecified in /etc/ssh/sshd_config.

--- previous (incorrect) answer ---

Use the -g option. From ssh's man page:

-g     Allows remote hosts to connect to local forwarded ports.
share|improve this answer
    
doesn't seem to be working... it starts up but i cant connect remotely –  Trevor Rudolph Apr 28 '13 at 6:21
1  
Try running netstat -elnpt from a separate tty to figure out what ports are bound to what address. Without -g, a port should be bound to 127.0.0.1:PORT. With -g, it should be bound to 0.0.0.0:PORT, which makes it accessible remotely. –  snapshoe Apr 28 '13 at 14:58
    
pastebin.com/q6f4kJyd –  Trevor Rudolph Apr 28 '13 at 16:11
    
GatewayPorts=clientspecified or GatewayPorts clientspecified –  Trevor Rudolph Apr 29 '13 at 0:01
    
and do i add that to the client or remote? –  Trevor Rudolph Apr 29 '13 at 0:04

Here's my answer for completion:

I ended up using ssh -R ... for tunneling, and using socat on top of that for redirecting network traffic to 127.0.0.1:

tunnel binded to 127.0.0.1: ssh -R mitm:9999:<my.ip>:8084 me@mitm

socat: mitm$ socat TCP-LISTEN:9090,fork TCP:127.0.0.1:9999

Other option is to do a local-only tunnel on top of that, but i find this much slower

mitm$ ssh -L<mitm.ip.address>:9090:localhost:9999 localhost

share|improve this answer
    
I like the fact that I don't have to deal with the sshd configuration and that I can do all of it without sudo. Plus I learn that socat exists. Thanks! –  BrutusCat Jun 12 at 14:00

Use the "gateway ports" option.

ssh -g -R REMOTE_PORT:HOST:PORT ...

In order to use that, you probably need to add "GatewayPorts yes" to your server's /etc/ssh/sshd_config.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.