I have the following setup:

  • Raspberry Pi with no public IP address
  • Public "jumpserver"

Currently i have autossh running on the Raspberry to connect to the jumpserver.

Works without problems. I connect to the jumpserver via ssh and from there via ssh to the Raspberry Pi.

Now i want to add a VNC client on the Raspberry to the game so i can directly connect to it from my local machine. My plan would be:

  • Start VNC on the Raspberry (Port 5901)
  • Make an connection with autossh to create a reverse tunnel between localhost:5901 and jumpserver:1702
  • Create iptable-entries on the jumpserver to forward incoming traffic on port 5555 to localhost:1702

The first question is: Could this work like this? Not sure about the vnc port on the Raspberry being the same as the local port auf autossh. Or would i need another local port for autossh and also use iptables on the Raspberry to forward the incoming traffic from autossh to the VNC port?

Any help is appreciated.

Thank you

I already created iptable entries on the jumpserver like this, but it doesnt work:

sudo iptables -t nat -A PREROUTING -p tcp --dport 5555 -j DNAT --to-destination
sudo iptables -t nat -A POSTROUTING -p tcp -d --dport 1702 -j SNAT --to-source

1 Answer 1


The use of DNAT-to-localhost is somewhat redundant given that you could just as well have the SSH tunnel listen on directly. (To allow this, enable GatewayPorts on the listening side of the tunnel, i.e. on the jumpserver's sshd_config – GatewayPorts clientspecified will allow you to specify the listening address as part of the ssh -R option.)

Redundancy aside, the DNAT rule seems like it would work (there is in fact even a REDIRECT target specifically for NATing to localhost).

On the other hand the SNAT rule is useless, and it seems like you're confusing how source/destination ports work. A connection made to port 5555 does not need to come from port 5555 (it's only the reply packets that do; keep in mind that iptables NAT will automatically handle reverse NAT for reply packets).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .