Now if I am not mistaken, an SSH tunnel of port 80 to a web server on port 80 should allow my port 80 to tunnel through that server, correct? However, when I set up a tunnel and access a website, my log still appears to come from my home computer instead of the server's IP. Any ideas why?

I use the following command but all it appears to do is just SSH into the host in the terminal:

ssh root@webserver -L 80:
  • I may be wrong, but I think you want ssh -f root@webserver -L LOCALPORT:HOST:REMOTEPORT-N. -f is for ssh to go to the background, -N tells OpenSSH to not execute a command on the remote system. Of course, I hope you aren't actually using root as the user...
    – nerdwaller
    Jan 24 '13 at 8:51
  • Thanks, I'll give it a shot. Yes, I am using root because for some silly reason su is required in order to set up the tunnel.
    – Peter
    Jan 24 '13 at 9:02
  • @Ryan: I don't think it is a "silly" reason, I think that it is because you are trying to tunnel a protected system port (e.g. <1024) for which you need system rights. Jan 24 '13 at 22:05

Just tried this and confirmed that it was working:

ssh -ND 8080 username@domain.com

Root is required to bind the local port 80 on your machine since it's a reserved port (and 8080 is the common alternate). To forward just your browser traffic you could set Firefox / Chrome / Whatever to use a Socks proxy "localhost" on "8080".

Try it without root, works for me on a webserver that I do not have root access to.

  • Ha, I should have read down to here before putting in my comment on the question itself. Jan 24 '13 at 22:07
  • @JulianKnight No worries! Perks of a community based system - nothing wrong with reiterating the point (and expanding on it to mention <1024, which I omitted).
    – nerdwaller
    Jan 24 '13 at 23:16

Once the tunnel is set up (with -L) you need to change the URL you use, e.g. or if the site name must match due to the virtual-hosting set up then you'll need to add that to your desktop hosts file:    www.domain.com

You could define an alias on the server vhost so that you can use one name for like "test.domain.com", and the real name to go directly, if that's ever going to be useful -- forgetting to remove entries from the hosts file is a good way to cause confusion. Depends on how the site works.

To forward port 80 you only need to be root on the desktop, ''not'' the webserver. I'd strongly suggest not allowing ssh login for root.

Using a non-privileged port may work, again depending on your site:

ssh user@webserver -L 1080:

and use the URL .

Using a SOCKS proxy (-D) as suggested may cause some surprises, depending on SOCKS/DNS/firewall/NAT configuration.

(On linux as an alternative to being root for reserved ports you can use POSIX capabilities, see https://stackoverflow.com/questions/413807/is-there-a-way-for-non-root-processes-to-bind-to-privileged-ports-1024-on-l , however this will not work on standard versions of OpenSSH as it has an extra hard-coded check on port numbers, unless compiled with NO_IPPORT_RESERVED_CONCEPT defined. The answers to the linked question have various other solutions to that.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.