I want to copy files from a remote computer (W) to a private host computer (P) via scp. Since i can't connect to machine W directly i use an ssh tunnel over 2 different machines with port 22. What i would like to do, is to log into machine W and from there do an scp file transfer to machine P, the problem is that P is hidden in an network so i cant specify a remote host ip when i am logged into machine W. Is there a solution for this ?? I manage to do this when i am logged into machine P, but i dont want to remember the file path each time i copy a file.

  • So your setup looks something like this? W -- ? -- ? -- P May 22, 2013 at 16:06
  • yes exacty, there are 2 machines between these computers on which i do a port forwarding, the problem is that W is hidden behind some kind of router.. of my dormitory
    – jruebsam
    May 22, 2013 at 16:09
  • Do you have shell access to the router/host in front of P? Or can you do a port forwarding on either of the ones marked by ?? May 22, 2013 at 16:24
  • i don't have any access to the router, i have access to both machines in the middle (lets call them M1 and M2), but not as root, and i can also do a portforward to M2 for example
    – jruebsam
    May 22, 2013 at 17:00
  • Wait a second, is your network setup actually looking like this? W -- M1 -- R1 -- M2 -- P ? Or what exactly is the network path between W and P? May 22, 2013 at 17:55

2 Answers 2


After clarifying your setup as discussed above, your system looks like this:

P -- R -- M1 -- M2 -- W

R is a NAT router that only allows connections from P to M1, but not the other way around and all nodes must be used in order to establish a connection.

Solution 1

Your only real problem is the router R over which you have no control, so you must somehow establish a tunnel to allow W to connect back. The simplest solution would be to have P establish an SSH connection to M1 and establish a reverse port forward there.

You can then set up a second SSH tunnel from W to M2 to forward local packets to the reverse port forwarded port on M1, which can in turn be used to establish a tunneled SSH connection from W to P.

Solution 2

Now this adds quite some complexity to the whole setup, which makes it quite error prone. A better solution would be to establish a VPN connection between W and M1, P and M2 and between M1 and M2. Then you could establish a routing using a private address range from W to P over these three tunnels. For this to work you need root access to both M1 and M2 AND you need to set up proper firewalls so nobody from the outside gets into your VPN's.

There are of course other solutions as well, but what you need to think through how the packets are going to get through all these blockades, the actual solution can then be tailored to fit your tools.

  • Thank you for your reply, i managed to get Solution 1 to work, Solution 2 drops out since i don't have root access. I now can login from W to P with ssh -l userame -p 2210 localhost. Just one question left is, how exactly do i use scp i.e. pass the username the port etc, i didn't managed to get this to work ? I tried something like scp parameter.ini -p 2210 username@localhost:~/parameter2.ini after three password attempts i get the following message Permission denied (publickey,keyboard-interactive). lost connection
    – jruebsam
    May 23, 2013 at 11:04
  • 1
    @jruebsam: scp uses a capital P for port, so scp -P 2210 file user@localhost:~/destfile. I really don't know why ssh and scp are inconsistent there -- probably for historic reasons, as always when you can't explain something with arguments ;)
    – mpy
    May 23, 2013 at 12:34
  • @mpy: This gives me an new error message ssh: connect to host localhost port 2210: Connection refused lost connection
    – jruebsam
    May 23, 2013 at 12:38
  • @mpy: Ok, i don't know where the mistake was but it seems to work now with the command like above
    – jruebsam
    May 23, 2013 at 15:42

I would recommend mounting the remote file system locally using sshfs. I don't know the details of your setup but I'll give you an example. I set up a tunnel through a remote server (R1) to an inaccessible second server (R2) on R1's network with this command:

ssh -fN -p 24222 user@R1 -L 2222:R2:22

I can now connect to R2 like so:

ssh -p 2222

I can also use sshfs to locally mount a directory from R2:

sshfs -p 2222 /mnt/mountpoint

I have tried this using a tunnel through one not two remote servers but I see no reason why it should not work with 3 or more as long as the tunnel has been properly set up.

This is not exactly what you asked for but it should serve as a workaround. Once you have the remote file system mounted locally, you can use simple cp to copy files to/from it.

  • I actually used this method before, the problem is that the connection is kind of unstable and it often happens that my terminal and the file browser freeze
    – jruebsam
    May 22, 2013 at 17:01
  • 1
    @jruebsam You should be able to avoid such problems if you mount the sshfs share using autofs (see here) with the soft option.
    – terdon
    May 23, 2013 at 3:12
  • Thank you for your reply, i think i might give autofs a try, i hope it really works better then with sshfs.
    – jruebsam
    May 23, 2013 at 11:10
  • sshfs has nothing to do with it... scp works just fine once you setup the tunnel with ssh -fN
    – slf
    Sep 5, 2014 at 19:07
  • @slf of course, it is just a more convenient way of doing this sort of thing if you are going to be doing it often.
    – terdon
    Sep 5, 2014 at 19:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .