ssh tunnel: listening on the ssh server

Question

Here is what I am trying to do:

ssh me@server1 4000:server2:4000

With this command, I can connect to server2:4000 by connecting to localhost:4000

What I want to do is to connect on server1:4000 Is there a way to do that ?

Thanks

Answer 1

I'd expect your example to look like ssh -L 4000:server2:4000 me@server1

There are several ways to interpret your question:

• Connect to an SSH server on server1 using port 4000: ssh -p 4000 me@server1
• Jump through one SSH connection to another: ssh -J localhost:4000 me@server1
• Forward a port local to the server to you: ssh -L 4000:localhost:4000 me@server1

If the service doesn't listen on its server's localhost, you may have to specify a different name or IP. Most services listen on 0.0.0.0 (every IP), so this won't matter. Some services only listen on localhost. You should see how similar my third example is to my rewrite of your example. It's doing the same thing but with a different host (a local host).

If you want to make that permanent, you can add this to your ~/.ssh/config and uncomment the line that matches your desired action:

Host server1
  User me
  # directly connect to port 4000
  #Port 4000
  # proxy through port 22 to port 4000
  #ProxyJump localhost:4000
  # forward port 4000 to localhost
  #LocalForward 4000:localhost:4000

then you can simply run ssh server1 to connect.

Documentation for the command line (more at man ssh):

-J destination

Connect to the target host by first making a ssh connection to the jump host described by destination and then establishing a TCP forwarding to the ultimate destination from there. Multiple jump hops may be specified separated by comma characters. This is a shortcut to specify a ProxyJump configuration directive. Note that configuration directives supplied on the command-line generally apply to the destination host and not any specified jump hosts. Use ~/.ssh/config to specify configuration for jump hosts.

-L [bind_address:]port:host:hostport

Specifies that connections to the given TCP port or Unix socket on the local (client) host are to be forwarded to the given host and port, or Unix socket, on the remote side. This works by allocating a socket to listen to either a TCP port on the local side, optionally bound to the specified bind_address, or to a Unix socket. Whenever a connection is made to the local port or socket, the connection is forwarded over the secure channel, and a connection is made to either host port hostport, or the Unix socket remote_socket, from the remote machine.

Documentation for the configuration (abridged; more at man ssh_config):

ProxyJump

Specifies one or more jump proxies as either [user@]host[:port] or an ssh URI. Multiple proxies may be separated by comma characters and will be visited sequentially. Setting this option will cause ssh(1) to connect to the target host by first making a ssh(1) connection to the specified ProxyJump host and then establishing a TCP forwarding to the ultimate target from there.

LocalForward

Specifies that a TCP port on the local machine be forwarded over the secure channel to the specified host and port from the remote machine. The first argument specifies the listener and may be [bind_address:]port or a Unix domain socket path. The second argument is the destination and may be host:hostport or a Unix domain socket path if the remote host supports it.