I am working on a server app residing on a remote Ubuntu 14.x server. That app is listening on port 8000 on the remote box. I have a proper SSH session so I am tunnelled into the box, and I also have sudo capability.

I have IntelliJ on my local Linux system in my office and it too is running ubuntu 14.x. I need to have it connect to port 8000 on the remote box for an IntelliJ remote debugging session. Port 8080 on the remote box is not available publicly.

Is there a utility, or IP tables trick (on the remote box), or SSH trick, etc. that can provide a local port on my system for IntelliJ to connect to, and then will proxy/forward traffic to and from that port over the SSH tunnel to port 8000 on the remote system? In other words, it will make IntelliJ on my local box think it's talking directly to the server app on the remote box, when in reality the connection between them is going through the active SSH tunnel?

I remember doing something like this a long time ago but I completely forgot how, and back then the remote client was a Windows box so the solution was for Windows systems. This time both the local system and the remote system are Ubuntu 14.x servers.


Set up a forward tunnel on the local machine

autossh -f -N -L username@remotebox is what IntelliJ will connect to, it will think that the web app is running on the local machine, bound to every local interface and running on port 8000.

localhost:8000 is where the tunnel will connect to, in the context of the remotebox. localhost is no longer the localhost you are working on, but the localhost interface inside the remotebox machine. There it will connect to port 8000, which effectively is your web app, from the context of the user username.

autossh is a wrapper for ssh which takes care of reconnecting automatically should the connection drop.

If you are using a non-standard port for ssh on the remotebox, use the -P <PORT> parameter to connect to it.

This answer is worth looking at if above doesn't do what you want: https://unix.stackexchange.com/a/118650/61956 from there I just explained you the first diagram. I prefixed the local port with the interface, I think it defaults to localhost when you omit it, which you can do if you want to. It might be more secure to remove the part, because if localhost is the default, then nobody on your network can use your machine to use that ssh tunnel. Else for them would be an entry point to the remote web app if is the IP of the machine you are working on.

  • This is extremely helpful. Thanks a lot. May 5 '19 at 19:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.