I'm on a Linux laptop and am trying to access my Windows Workstation which sits behind two (!) Linux servers (server1, server2), of which only server1 is accessible from the outside, and only server2 can access the workstation:

Linux -> server1 -> server2 -> windows:3389

I'm trying to get a remote desktop connection to the Windows machine.

I managed to set up a tunnel that can forward ssh to server 2, by running on my laptop:

ssh -f -N -L 2001:server2:22 server1

And connecting by:

ssh -p2001 localhost

So this creates a tunnel from my local port 2001 through server 1 to server2:22. I also managed to run sftp through this so I can access data on server2 directly from a file manager window rather than the console using


in the adress line.

Great, now onto the next level. I ran on server1:

ssh -f -N -L 2222:windows:3389 server2

This should connect port 2222 on Server1 to the RDP port on the workstation. Now, should I not be able to just direct my RDP software (I tried Remmima and KRDC) to Server1:2222, and be done with it? Unfortunately, this does nothing (connections time out). Remmina has tunneling options but I'm thoroughly confused as to whether they can help me in this situation.

So: What am I getting wrong?


Now, should I not be able to just direct my RDP software (I tried Remmima and KRDC) to Server1:2222

No, ssh binds port forwarding to localhost interface by default, so the port is not accessible "from outside".

You need to bind external interface, which will make your internal windows service accessible for everyone who sees the server1. This will also need to tweak GatewayPorts option in ssh config on server1:

ssh -f -N -L server1:2222:windows:3389 server2

or you need to tunnel once more, directly to your machine, for example like this from your computer:

ssh -fNL 2222:localhost:2222 server1

and then connect to your localhost:2222.

|improve this answer|||||
  • it works, magic! The thing I had not understood was that the way I tried requires a public port but I would not want to create a public port, for the same reason that the machine is not exposed to the public internet in the first place... just the two lines you quote solve the problem – Zak Dec 1 '15 at 11:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.