I currently use SSH to tunnel my internet connection, using ssh -p <port> -ND <local port> <user>@<ip address>, and this works great. However, I'd like to bind a local port to a port that's open on the computer I'm SSHing to, but not open to the outside world, so that I can connect to the service on the machine I'm SSHing to on my local machine by references a port (say, 1234) like localhost:1234, instead of, say, remotehost:5678 (which will not work in my situation because of firewall issues).

  • just curious, doesn't "bash" imply "linux" and isn't it also more specific? – Eva Dec 6 '12 at 17:26
  • No, BASH could be OSX, UNIX or a number of other OSs and in any case your question is about ssh port forwarding and so has nothing to do with BASH which is a shell. – terdon Dec 6 '12 at 17:30
  • I see, but wouldn't the command also work on OSX or Unix? Or do they not have the "ssh" command in bash? (I ask because my question is specifically about ssh / port-forwarding with bash and not with a GUI such as something like Tunnelier) – Eva Dec 6 '12 at 17:36
  • The ssh command is not connected to BASH in any way. In most Linuxes it is part of the openSSH package. You can run it using any of a number of shells (BASH,tcsh, zsh whatever) but it is not a part of any of them. That is why I removed the BASH tag, it was misleading since your question is not in any way dependent on BASH. – terdon Dec 6 '12 at 17:40
  • Ah OK - thanks for clearing that up for me :) – Eva Dec 6 '12 at 17:41

You need to use the Bind Address option of ssh:

 -L [bind_address:]port:host:hostport
         Specifies that the given port on the local (client) host
         is to be forwarded to the given host and port on the
         remote side.  This works by allocating a socket to lis‐
         ten to port on the local side, optionally bound to the
         specified bind_address.  Whenever a connection is made
         to this port, the connection is forwarded over the
         secure channel, and a connection is made to host port
         hostport from the remote machine.  Port forwardings can
         also be specified in the configuration file.  IPv6
         addresses can be specified by enclosing the address in
         square brackets.  Only the superuser can forward privi‐
         leged ports.  By default, the local port is bound in
         accordance with the GatewayPorts setting.  However, an
         explicit bind_address may be used to bind the connection
         to a specific address.  The bind_address of “localhost”
         indicates that the listening port be bound for local use
         only, while an empty address or ‘*’ indicates that the
         port should be available from all interfaces.

So, for example, to bind local port 1234 to port 6667 of the remote server server.example.com, you would do something like this:

ssh -f -L 1234:localhost:6667 server.example.com 

assuming the ssh host is publicly accessible, you probably want to look into Port Knocking Heres one way to apply it to SSH: http://www.marksanborn.net/linux/add-port-knocking-to-ssh-for-extra-security/


take a look here: http://dzervas.gr/notes/ssh-tunnel/ It actually create a socks local proxy where all data is passed are sent to the sshed machine, on any port.


Your question is a little strange, because are you asking How do you set the remote computer up to only take access from your source computer, with ssh?

Or are you asking how do you set it up to restrict access to only allow your computer, with anything, and then connect to it with ssh.

Or are you saying it's already set up like that, how do you now connect with SSH.


Look at this thread here it mentions a few ways to restrict access, it mentions doing so with SSH or with iptables(a firewall), and if you then want to then connect with SSH, that's just normal.

Why not add in your /etc/host.allow: sshd: IPADDRESS, IPADRRESS


Something like this in /etc/ssh/sshd_config perhaps? AllowUsers andy@192.168.1.*,,

billy@192.168.1.* charlie@192.168.1.*


The AllowUsers option for sshd_config is the easiest

route if you know who the users are. Alternatively,

there is the equally easy tcp_wrappers way

(/etc/hosts.allow and /etc/hosts.deny).


Probably easier to setup a firewall rule something like iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 --source [accepted ip address here] -j ACCEPT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.