This is the command for the orange computer:
ssh -N -R:<chosen-port>:10.0.0.101:<web-app-port> -p <blue-ssh-port> <blue-user>@<blue-public-ip>
(How to make it survive your logout from the orange – it's a separate issue. See this; or
nohup with custom script.)
The command above makes the SSH server on the blue listen on the (TCP)
<chosen-port> of your choice on the loopback interface. Incoming connections will be tunneled to the orange and sent to
10.0.0.101:<web-app-port> (i.e. the red) from there. This creates a tunnel without executing a command nor shell on the blue (thanks to
There is a way to make the blue listen on the other (non-loopback) interface but it's not recommended because of security; this option may be even disabled on blue (explained in
To reach the blue loopback interface from your green home machine use another tunnel. On green:
ssh -N -L:<chosen-port-2>:127.0.0.1:<chosen-port> -p <blue-ssh-port> <blue-user>@<blue-public-ip>
Now you should be able to reach the red from the green using the address:
<chosen-port-2> may or may not be the same number, it really doesn't matter. What matters is you should choose high ports (from 1024 to 65535).
The difference between
-L listens on the local side i.e. where you invoke
-R listens on the remote side i.e. where you
Knowing this you should be able to trace what we just did. Note that we created the tunnels moving towards the green because (to me) it seemed more logical to work this way. Your connection will go from the green so let's trace the whole route in this direction. It is as follows:
- SSH client on the green listens on
127.0.0.1:<chosen-port-2> because of the second tunnel.
- It forwards the packets to SSH server on the blue which sends them to
127.0.0.1:<chosen-port> there. From the blue perspective these are local packets generated by the SSH server.
- The same SSH server listens on that port because of the first tunnel. The server grabs the packets and forwards them to the orange.
- SSH client on the orange sends the packets to the red. From the red perspective the packets are from the orange, it knows nothing about the blue nor the green.