I am trying to access a web application that is currently hosted behind the company firewall from my home laptop.

I found plenty of questions and responses on how to create SSH tunnels, SSH proxy or SSH tunnel via multiple hops. But, I still can't make it work. I believe my case is a bit different than others. Let me explain :

  • I don't have a SSH access to the server hosting the web application (red box), it only has an internal IP.
  • I have access to an on-premise linux box (orange box) that can reach the server hosting the web app.
  • The orange box doesn't have a public IP address (so I cant SSH to it from the Internet), but it has access to the internet and I could execute SSH to a server hosted on the internet (for example connect to the blue box from the orange box).
  • I have a linux server on the internet with a public IP address (blue box).

enter image description here

I tried different things without success, but I am getting lost honestly.

Would anyone be kind of enough to enlighten me ? :-)


This is the command for the orange computer:

ssh -N -R:<chosen-port>:<web-app-port> -p <blue-ssh-port> <blue-user>@<blue-public-ip>

(How to make it survive your logout from the orange – it's a separate issue. See this; or tmux/screen, disown or nohup with custom script.)

The command above makes the SSH server on the blue listen on the (TCP) <chosen-port> of your choice on the loopback interface. Incoming connections will be tunneled to the orange and sent to<web-app-port> (i.e. the red) from there. This creates a tunnel without executing a command nor shell on the blue (thanks to -N option).

There is a way to make the blue listen on the other (non-loopback) interface but it's not recommended because of security; this option may be even disabled on blue (explained in man ssh, -R option).

To reach the blue loopback interface from your green home machine use another tunnel. On green:

ssh -N -L:<chosen-port-2>:<chosen-port> -p <blue-ssh-port> <blue-user>@<blue-public-ip>

Now you should be able to reach the red from the green using the address:<chosen-port-2>

<chosen-port> and <chosen-port-2> may or may not be the same number, it really doesn't matter. What matters is you should choose high ports (from 1024 to 65535).

The difference between -L and -R tunnels:

  • -L listens on the local side i.e. where you invoke ssh;
  • -R listens on the remote side i.e. where you ssh to.

Knowing this you should be able to trace what we just did. Note that we created the tunnels moving towards the green because (to me) it seemed more logical to work this way. Your connection will go from the green so let's trace the whole route in this direction. It is as follows:

  1. SSH client on the green listens on<chosen-port-2> because of the second tunnel.
  2. It forwards the packets to SSH server on the blue which sends them to<chosen-port> there. From the blue perspective these are local packets generated by the SSH server.
  3. The same SSH server listens on that port because of the first tunnel. The server grabs the packets and forwards them to the orange.
  4. SSH client on the orange sends the packets to the red. From the red perspective the packets are from the orange, it knows nothing about the blue nor the green.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.