Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Consider ssh -R '' restricted@myvps.example.com

  • A laptop is running a webserver on port 5050
  • The laptop is behind a router with NAT and port forwarding cannot be configured
  • A VPS is sitting out on the internet as myvps.example.com
  • restricted has /bin/rbash as the shell with PATH="" (no execution possible)
  • When a user visits http://myvps.example.com:9090 they can interact with the webserver on the laptop's localhost:5050 (although the Host: header is incorrect)

The remaining problem is that the untrusted laptop could remote forward port 9091, which is reserved for another computer's use.

My goal is to create a system that can allow multiple untrusted computers behind NATs to have 2 ports (each) forwarded from a public VPS to their localhost.

Using ssh isn't required, but it provides both a method for identification and port forwarding, which are required.

It would be simpler to restrict ports on a per-key (or per-user) basis, especially since more than one machine behind a single NAT may use the system (and hence IP addresses aren't reliable for identification).

After more searching it seems that this isn't possible yet: https://bugzilla.mindrot.org/show_bug.cgi?id=2038

I wonder if there's another solution that could work for the use case...

share|improve this question
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.