There is an active, and passive mode when we talk about torrent. Passive, is when you can't connect to the peers actively. Active is when your ports are forwarder, and others can connect to you.

What I did so far, is installed a Debian on my server. Then I added GatewayPorts yes into my sshd_config file. After that, in PuTTY, I set up the following configuration:
- Remote ports do the same
- Local ports accept connections from other hosts
Then I added a new forward like:
4D8080 (IPv4, Dynamic, at my PC's port 8080).

After this, I set my uTorrent to use SOCKS5 proxy for every possible connection, at localhost, port 8080. But, my client will show the red sign at the bottom-right part.

Is there a solution to this? (Something is surely not right, I get 0 DHT nodes too.)

  • Your description tells us how you connect to your debian server, so presumably your outgoing torrent connection is putty->debian->internet. You are advertising a port range in your client, how are these ports getting to the debian server? Is it on a public IP?
    – Paul
    Dec 14, 2011 at 12:59
  • The server is on a public IP, yes. I'm using a random port (let's say 23456 in my torrent client), and a 8085 like port in my PuTTY + uTorrent's proxy page. My PC (uTorrent) -> SOCKS5 ( -> PuTTY (remote IP) -> Debian server (with public IP and SSH server, and GatewayPorts yes) -> Internet.
    – Apache
    Dec 14, 2011 at 15:32
  • There is a howto by the MyEnTunnel's author, which sadly doesn't work. nemesis2.qx.net/forums/index.php?topic=23.0 But maybe, someone will be able to solve the mystery.
    – Apache
    Feb 14, 2012 at 19:34

3 Answers 3


Your two problems (not being connectable and not finding DHT nodes) are related, but they have different causes and different (partial) solutions.


To be able to accept incoming connections, you have to accomplish three things:

  • Forward the remote port uTorrent listens to to your client machine.

    In Preferences → Connection → Listening Port → Port used for incoming connections, uTorrent lets you specify a single port for incoming connections. Set it to 40000 (for example).

    To forward this port, enter Connection → SSH → Tunnels in PuTTY and add the following forwarded port:


    Checking Local ports accept connections from other hosts is neither required nor desired for this. It's used to allow other machines to connect to your computer and make use of the forwarded local and dynamic ports.

    Checking Remote ports do the same is only required if you set GatewayPorts to clientspecified on your server. If it is set to yes or no, this option has no effect.

  • Make uTorrent report the correct IP to the tracker.

    By default, the tracker results to its best guess when adding an IP to the peer list. The dynamic port forwarding might (this depends on the tracker) cause a local IP address (10.xxx.yyy.zzz) to get added to the peer list. The IP that should get added instead is the one of your server.

    You can specify it in Preferences → BitTorrent → IP/Hostname to report to tracker. Not all trackers respect this setting, but it should help.

  • Allow uTorrent to accept incoming connections.

    In Preferences → Advanced, you can modify the bit field bt.transp_disposition.

    When using a SSH tunnel with remote port forwarding for TCP and UDP connections (see below), I'd set it to 13. This allows outgoing TCP and incoming TCP and UDP peer-to-peer connections.

DHT / UDP connections

PuTTY and SSH don't listen on any UDP port, so neither the dynamic nor the remote port you forwarded will work out of the box. Since DHT uses UDP, it won't work either.

  • Incoming UDP connections

    If you install socat on you server (apt-get install socat) and on your client machine (using Socat for Windows), you can transform incoming UDP connections to TCP connections, forward them through the tunnel and convert them back to UDP connections on your client machine.

    To do so, execute

    socat udp4-listen:40000,reuseaddr,fork tcp:localhost:50000

    on your server and

    socat tcp4-listen:50000,reuseaddr,fork UDP:localhost:40000

    on your client machine.

    The choice of port number 50000 is arbitrary, but it has to be different from 40000 (to be able to distinguish one connection type from the other).

    For the actual forwarding, enter Connection → SSH → Tunnels in PuTTY and add the following forwarded port:

  • Outgoing UDP connections

    Routing outgoing UDP connections through the SSH tunnel isn't as easy and might even be impossible. The method from above won't work since socat only listens to a specific port, while the destination port of an outgoing connection could be anything. Also, once a TCP packet reaches the dynamically forwarded port, you can't control what happens to it.

    It would be possible to set up UDP connections on a peer-by-peer basis, but that's probably not worth the effort. DHT should work fine with incoming connections, once you've conected to the first peer.

  • Another five-star answer Dennis. I'll try this out tomorrow. :)
    – Apache
    Aug 3, 2012 at 21:28

you need to do it the other way around ... You need to have remote ports accepting connections from other hosts. And a firewall rule on your server allowing incoming traffic to the listening port set in utorrent preferences. (although i'm not sure if this gets propagated through socks - you need to try it out and check netstat)

  • As far as I know, GatewayPorts do the first thing you mentioned. About the firewall... there is no firewall, no iptables. It's disabled.
    – Apache
    Dec 14, 2011 at 12:29
  • (Uhm.. and if someone knows what I'm missing, please elaborate. Be noob friendly, I'm new to this thing. And I guess if someone will do a Google search on the topic, will appreciate it too. :))
    – Apache
    Dec 14, 2011 at 12:33

The dynamic SOCKS proxy mode (the "D" option) cannot handle incoming connections for you because there's no such provision in the protocol. A proxy protocol is only supposed to handle your outgoing connections after all.

You need to add a remote redirection (the "R" option), so your SSH server listens on a port and redirects the packets to you. See the following man page extract:

 -R [bind_address:]port:host:hostport
     Specifies that the given port on the remote (server) host is to
     be forwarded to the given host and port on the local side.  This
     works by allocating a socket to listen to port on the remote
     side, and whenever a connection is made to this port, the connec-
     tion is forwarded over the secure channel, and a connection is
     made to host port hostport from the local machine.

     Port forwardings can also be specified in the configuration file.
     Privileged ports can be forwarded only when logging in as root on
     the remote machine.  IPv6 addresses can be specified by enclosing
     the address in square braces or using an alternative syntax:

     By default, the listening socket on the server will be bound to
     the loopback interface only.  This may be overriden by specifying
     a bind_address.  An empty bind_address, or the address '*', indi-
     cates that the remote socket should listen on all interfaces.
     Specifying a remote bind_address will only succeed if the
     server's GatewayPorts option is enabled (see sshd_config(5)).

Note however this port forwarding feature can change origin IP of the remote peer which can mess up the bittorrent protocol. If this is the case, you need to use VPN instead of SSH.

  • Where can I find this "R" option in PuTTY? Or should I use Cygwin? By the way, I tried using the remote redirection (in Tunnelier), but uTorrent didn't work at all.
    – Apache
    Dec 14, 2011 at 15:46
  • (The protocol stuff: BTguard.com uses SOCKS5 proxy too and it works perfectly. That's why I thought PuTTY/SSH would work.)
    – Apache
    Dec 14, 2011 at 15:47
  • The option is called "Remote" in the same place you find the "Dynamic" option.
    – billc.cn
    Dec 14, 2011 at 15:47
  • SOCKS5 does support UDP which is usually used to do NAT-traversal. However, SSH may not support this.
    – billc.cn
    Dec 14, 2011 at 15:52
  • Maybe I'm doing something wrong. I tick the "Remote" option. THEN, Source port: 8081 (port is forwarded in my router, just in case); Destination: and IPv4. But after launching the connection, set uTorrent to this address, and it can't connect at all. :/
    – Apache
    Dec 14, 2011 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.