Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I rely on the following script tunnel.sh written by others to keep a ssh tunnel alive:

export SSH_HOST=tim@server 

if [ ! -f /tmp/.tunnel ] 
echo "Creat SSH tunnel"
ssh -f -D 9999 $SSH_HOST "if [ -f ~/.tunnel ]; then rm ~/.tunnel; fi; while [ ! -f ~/.tunnel ]; do echo > /dev/null; done" & 
touch /tmp/.tunnel 
echo "Close SSH tunnel"
ssh $SSH_HOST "touch ~/.tunnel" 
rm /tmp/.tunnel 

To create a persistent ssh tunnel, I just issue tunnel.sh. The tunnel will not be closed until I issue tunnel.sh again.

I was wondering how I can verify if the ssh tunnel is indeed created successfully?

My main use of the tunnel is to print documents to some printers in the same LAN as the server, and the printers can only be accessed from within the LAN. After creating a tunnel, now printing doesn't report any problem, but since I am not physically there, I cannot check if the documents have been indeed printed.

I thought since I am now in the LAN thanks to the tunnel, my external IP should be the same as the server's. But actually they are not the same (I found them out by wget -q -O - checkip.dyndns.org|sed -e 's/.*Current IP Address: //' -e 's/<.*$//'). I wonder why? When I connect to some website on the internet with the tunnel alive, isn't the server the midpoint between me and the internet website in the connection, due to the tunnel between me and the server?

share|improve this question

Thats a lot more complicated than it needs to be :-)

Start the tunnel:

ssh -f -N -D 9999 -M -S /tmp/ssh_tunnel_%h.sock -o ExitOnForwardFailure=yes $SSH_HOST && \
echo "ssh tunnel started successfully" || \
echo "ssh tunnel failed to start"

Stop the tunnel:

ssh -S /tmp/ssh_tunnel_%h.sock -O exit $SSH_HOST


Thats all you need to do. If you want the details, skip below.

For your second question, the IP one. No, your IP does not change. All you did was to create a SOCKS proxy through the remote host. Your system does not automatically use this proxy unless you tell it to.

SSH explanation
Args for starting the tunnel:
-f: Tell ssh to background itself. It will only background itself if it starts up successfully (cooperates with the -o argument below).
-o ExitOnForwardFailure=yes: This tells ssh to exit if it cant set up the SOCKS proxy.
-N: Dont execute a command. We just want to tunnel, not do anything on the remote host.
-D 9999: Your SOCKS proxy.
-M: This is required for the -S argument to work here.
-S /tmp/ssh_tunnel_%h.sock: This tells it to use /tmp/ssh_tunnel_HOSTNAME.sock for its control socket. The -M option tells it that ssh needs to set this socket up and not issue commands to another ssh already listening on the socket. You can use this socket to set up additional tunnels after the ssh is already running. The %h uses the hostname of the remote host as part of the filename.

Args for stopping the tunnel:
-S /tmp/ssh_tunnel_%h.sock: This should be obvious. However since we didnt issue a -M, that means ssh should connect to the socket thats already there and tell it what to do rather than doing anything itself.
-O exit: This is part of the -S. We tell the ssh listening on the socket to exit.
The $SSH_HOST is still required here. Even if you were to specify an absolute socket path, without using %h in the filename, ssh would still want a remote host to be specified. This is why I put the %h in the arguments. Might as well use it if ssh is going to ask for the host, and it keeps things organized.

share|improve this answer

This type of tunnel doesn't change your ip address information. All it does is tell your computer to open up port 9999, and forward connections to that port to the remote machine (tim@server) via your ssh connection. The easiest way to test that the connection is up, is to telnet to the port the forward has been created on (in your example 9999):

$ telnet localhost 9999
Trying server...
Connected to server.
Escape character is '^]'.

If you receive the "Connected to server." message, that means your tunnel is up. If, instead you get: "Unable to connect to remote host: Connection refused" your tunnel is not up.

As to your second question, for your browser, your browser will not use the tunnel, unless you tell it to. In the browsers network settings, you can configure proxy settings, and specify localhost:9999 as a socks5 proxy and then your web connections should use the ssh tunnel and appear to come from the server's IP address.

share|improve this answer
+1 Thanks! (1) When I print to a printer in the LAN, how does it know to go to port 9999 i.e. use the tunnel? Not anything else? (2) Are there types of tunnels that change my ip address information? – Tim Jan 24 '12 at 17:24
@Tim likely, that particular printer has been configured to print to a particular IP address and port. This depends on how your printer is setup. Usually, you can specify both when you define a printer. Yes, there are types of tunnels that will have their own IP information associated with them. Generally for these you create a seperate tun/tap en.wikipedia.org/wiki/TUN/TAP interface which will have it's own IP address attached to it, and all traffic that goes out of that address will appear to come from a different network. – gabe. Jan 24 '12 at 17:28
Thanks! In my Firefox's preferences, in advanced -> connection -> settings, I choose manual proxy configuration, and type "localhost" for HTTP Proxy and "9999" for its port. After that I cannot connect to any website in Firefox. I wonder why? – Tim Jan 24 '12 at 17:41
@Tim it's a little confusing... the proper thing to set is: SOCKS Host, and not HTTP Proxy. I had this same issue the first time I tried this. – gabe. Jan 24 '12 at 19:43

In my case (Google Chrome on Ubuntu 14.10), my external address does change, at least within the browser. Just google "What's my IP address?" with and without the proxy connection.

Also, after you set up the proxy, try destroying the tunnel and see if you can still get traffic. When I do this, chrome returns an error "Unable to connect to the proxy server".

Another way: after tunneling to the remote host, create a new ssh session and run tcpdump -A dst port 80. Then browse to some page and you should see the related traffic in the terminal.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.