37

I need to do remote port forwarding that will listen 0.0.0.0 instead of 127.0.0.1 on the remote machine so that I can connect from outside internet to IP_OF_BBB:SOME_PORT in order to connect to SSH port of AAA.

I managed to make this happen by the following:

  1. AAA:~$ ssh -R 22:localhost:2222 user@BBB
  2. BBB:~$ ssh -L 2222:*:2223 user@localhost

Now I can connect to AAA with this command:

ssh user@BBB -p 2223

The local port forwarding is a workaround, of course. Is there any clearer way to do this?

5 Answers 5

62

Enable GatewayPorts in sshd_config (by default it is disabled). Enabling it will instruct sshd to allow remote port forwardings to bind to a non-loopback address. AskUbuntu has a similar question about Reverse Port Tunneling that goes into more details.

3
  • 1
    use @anton-bessonov's answer to avoid having to modify your sshd_config.
    – ZombieDev
    Commented Jun 15, 2020 at 15:27
  • 4
    @ZombieDev No, that answer is wrong for the given question. It' valid for local forwarding, not remote.
    – Dmitry
    Commented Apr 15, 2023 at 13:29
  • The option GatewayPorts is not supported in dropbear.
    – Thomson
    Commented Nov 2, 2023 at 22:02
24

As addition to the existing answer you can use ssh -o GatewayPorts=true -L 2222:0.0.0.0:2223 user@localhost

4
  • 3
    The -o flag was not working for me. The question above worked.
    – camposer
    Commented Mar 22, 2021 at 10:13
  • 1
    Same for me, using the -o flag didn't work and the connection was still bound to localhost, enabling the GatewayPorts option in the config worked without any issues. Commented May 16, 2021 at 16:49
  • 10
    -o GatewayPorts=true seems not work with -R option (listen on remote)
    – yurenchen
    Commented Sep 18, 2021 at 18:20
  • Where are you supposed to run ssh -o GatewayPorts=true -L 2222:0.0.0.0:2223 user@localhost? On the remote or the local machine?
    – sdbbs
    Commented Jan 3 at 15:47
5

Not a SSH way, but why not use a socat trick on your remote host?

# this clones localhost:3129 to 0.0.0.0:3130
socat TCP-LISTEN:3130,fork,bind=0.0.0.0 TCP:localhost:3129

If you don't have socat yet simply install as:

apt update; apt install -y socat
3
  • Disadvantage (and possible root of conflictions): That way you are occupying 1 more port per application.
    – ceremcem
    Commented Jun 17, 2022 at 13:54
  • umm, yes. It's a workaround when the -o GatewayPorts=true on -R doesn't work. Commented Jun 17, 2022 at 16:36
  • 1. no root permissions 2. local address not accessible from server due to NAT etc Commented Aug 7, 2023 at 11:38
0

I have the same problem and could solve it by enabling GatewayPorts in /etc/ssh/sshd_config

GatewayPorts yes

and don't forget to restart ssh service systemctl reload ssh , then ssh using the -R parameter

ssh -R 777:localhost:7777 root@hostname
-2

BBB :ssh command should be:

BBB:~$ ssh -L 2223:*:2222 user@localhost

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.