4

I have two FreeBSD 9 hosts and I want to maintain a tunnel to reach firewalled host R from a high port on cloud host C.

ssh -y -i tunnel_id_rsa -o ConnectTimeout=60 -o ServerAliveInterval=20 
    -o ServerAliveCountMax=5 -oBatchMode=yes -o ExitOnForwardFailure=yes
    -nNR :11432:127.0.0.1:443 tunnel@c.mydomain.com

This works most of the time. But in the event that the port is bad and can't be listened to on C, I'm not seeing that information fed back to the calling client on R. Reading the docs and reading other questions, it seems like ExitOnForwardFailure is supposed to do this. But it doesn't... I see an error in the logs on c: error: bind: Address already in use

And then on R I just have a headless useless ssh connection to C that will never die and never do any good. What I want to do is just for that ssh process to die when the bind fails so I can retry.

Is there something else preventing protocol messages from getting back to the R? Something preventing ExitOnForwardFailure from working? I don't see anything on stderr on R about the error either, which seems suspicious based on other reports and questions.

(I've tried dropping the -y and -n options, as well as using a normal interactive password w/o a key... same result.)

2
  • Is this a bug in OpenSSH? I'm getting constantly burned (dozens of remote OpenWRT boxes behind NAT) by non-working ExitOnForwardFailure
    – andyn
    Aug 6, 2015 at 12:14
  • It seems it doesn't fail it it can bind one port even if another port fails: securityfocus.com/archive/121/505298/30/480/threaded
    – greg
    Dec 6, 2016 at 7:10

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy