Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Normally you have a setup like:

Workstation -> Firewall -> Server

Were your Workstation cannot contact Server directly, but has to use log in into Firewall first in order to contact Server. In this "easy" setup you can use this setting on your workstation:

Host server
    ProxyCommand ssh firewall nc %h %p

Now my question:

The setup that was forced upon me is more difficult:

Workstation -> Intermediate <- Server
  • I.e. my Workstation can log in into Intermediate and Server can log in into Intermediate.
  • Intermediate cannot open a TCP connection to Server, but the other direction is possible.
  • I cannot open a TCP connection in either direction between my Workstation and the Server. The packets simply won't be routed in the VLAN.
  • I can "physically" access the Server, but I'd like to sit at my Workstation.

Now, how can I SSH from my machine to the server?

share|improve this question
up vote 3 down vote accepted

Using ssh tunneling it is fairly easy; first go to your Server machine and run:

ssh -R 2222:localhost:22 intermediateuser@Intermediate

this opens port 2222 on intermediate machine, reverse forwarding connections to port 22 on the server.

Then you can

ssh user@Intermediate

and from there

ssh serveruser@localhost -p 2222

Or alternatively, you might bring port 2222 on Intermediate to your workstation with:

ssh -L 2222:localhost:2222 intermediateuser@Intermediate


ssh serveruser@localhost -p 2222
share|improve this answer
Thank you very much, exactly what I was looking for! – Kay May 27 '14 at 14:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.