tl;dr: A -> B and C -> B works. How to get A->C to work?

I have 3 hosts

A. A local machine
B. A middle-man
C. A phone with a webapp running on port 333

Both A and C can SSH into B. So, A->B and C->B works fine but A -> C does not work.

On B, I can access this webapp at http://localhost:3344 after creating a tunnel from C:

machine-c$ /usr/bin/ssh -f -N -T -R 3344:localhost:333 user@machine-b

I would have thought that with the above tunnel working all I need is a tunnel from A->B like so:

machine-a$ /usr/bin/ssh -f -N -T -L 9999:machine-b:3344 user@machine-b

I can see the following message:

Local connections to LOCALHOST:9999 forwarded to remote address machine-b:3344

But accessing localhost:9999 hangs with the following set of messages being repeated:

debug2: channel 3: zombie
debug2: channel 3: garbage collecting
debug1: channel 3: free: direct-tcpip: listening port 9999 for machine-b port 3344, connect from ::1 port 24626 to ::1 port 9999, nchannels 4
debug1: Connection to port 9999 forwarding to machine-b port 3344 requested.
debug2: fd 10 setting TCP_NODELAY
debug1: channel 3: new [direct-tcpip]
channel 3: open failed: connect failed: Operation timed out

Am not sure whether it's relevant, but since A -> B works, I have also setup a reverse tunnel so that B -> A works too. Ditto for B-> C. So overall the following works:

A -> B

machine-a$  ssh user@machine-b

B -> A (first requires a reverse SSH Tunnel from A->B)

machine-a$  ssh -f -N -T user@machine-b -R1234:localhost:22
machine-b$  ssh -p 1234 user@machine-a 

The same has been done for C->B

How can I setup an SSH tunnel from A to C (through B?) so that I can access that webapp directly on A using localhost:3344 ?

I have looked at the following questions but can't wrap my head around what's needed:

SSH as socks proxy through multiple hosts

Forward SSH traffic through a middle machine

An SSH tunnel via multiple hops

  • If what you are saying is correct Station B has network access to the web application on Station C. You also stated that you are able to successfully able to access Station B from Station A via SSH. What happens when you try to access the web application hosted on Station C when you initiate a SSH connection to Station B from Station A? – Dion Pezzimenti Apr 1 '14 at 15:10
  • I have updated my question with the details of what happens. Please take a look. – TheMinion Apr 1 '14 at 15:23
  • Try creating a Dynamic proxy going from A -> B and in the same session from B -> C. – Spencer5051 Apr 1 '14 at 15:44

I have a similiar setup in place and it is working fine. The difference I spotted is, in your machine-a ssh command you are using 9999:machine-b:3344 while I use 9999:localhost:3344. Your way doesn't work for me either, however it doesn't produce the same errors. For completeness, this is what I get:

debug1: Connecting to localhost [::1] port 9999.
debug1: Connection established.
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.5p1 Debian-6
channel 2: open failed: connect failed: Connection refused
ssh_exchange_identification: Connection closed by remote host`

The following commands do the trick for me:

machine-c$  ssh -f -N -T -R 3344:localhost:333 user@machine-b

Now on machine-a:

machine-a$  ssh -f -N -T -L 9999:localhost:3344 user@machine-b

As I don't have anything running on machine-c's port 333, I substituted it for 22 and check that the tunnel is working by simply connecting through ssh:

machine-a$  ssh -p 9999 user@localhost
| improve this answer | |
  • Wow! That totally works for me !!!!! Thanks a lot! Would you know why 9999:localhost:3344 works but 9999:machine-b:3344 does not ? – TheMinion Apr 1 '14 at 21:50
  • Well, localhost address on machine-b and machine-b address are two different things. The first command (from machine-c) makes the ssh daemon on machine-b listen on, but not on other adresses that machine-b has. The loopback interface is like another network device. So you were attempting to connect to the correct port, but on another network device. – TheDC Apr 2 '14 at 14:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.