Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to connect from my computer to a remote computer using a middle server(u port forwarding). I run this command on remote computer:

ssh -R 9300:localhost:22 user@middleserver

and this one on my system:

ssh remoteuser@middelserver -p 9300

But I get this error on my system:

ssh_exchange_identification: Connection closed by remote host

this is the log of remote computer:

debug1: client_request_forwarded_tcpip: listen localhost port 9309, originator xxx.xxx.xx.xx port 21470
debug2: fd 7 setting O_NONBLOCK
debug1: connect_next: host localhost ([::1]:22) in progress, fd=7
debug2: fd 7 setting TCP_NODELAY
debug3: fd 7 is O_NONBLOCK
debug3: fd 7 is O_NONBLOCK
debug1: channel 1: new [xx.xx.xx.xx]
debug1: confirm forwarded-tcpip
debug3: channel 1: waiting for connection
debug1: channel 1: connection failed: Connection refused
debug2: fd 8 setting O_NONBLOCK
debug1: connect_next: host localhost ([]:22) in progress, fd=8
debug2: fd 8 setting TCP_NODELAY
debug3: channel 1: waiting for connection
debug1: channel 1: connection failed: Connection refused
connect_to localhost port 22: failed.
debug2: channel 1: zombie
debug2: channel 1: garbage collecting
debug1: channel 1: free: xxx.xxx.xxx.xxx, nchannels 2
debug3: channel 1: status: The following connections are open:
  #0 client-session (t4 r2 i0/0 o0/0 fd 4/5 cc -1)

What's the problem?

share|improve this question

If the sshd on your middle server has not got the GatewayPorts configuration option set to yes (default is no view man 5 sshd_options) then you will have to specify a bind address on your forwarding:

ssh -R *:9300:localhost:22 user@middleserver

(you can specify the IP address of your local machine to make that more restrictive).

Without that only the loopback device is forwarded on middleserver.

share|improve this answer

( the error you report is indicative of a problem in step1 below )

First of all, do as the above poster mentioned: add GatewayPorts yes into /etc/ssh/sshd_config and change your ssh -R line to

ssh -vvv -R *:9300:localhost:22 user@middleserver

(remove -vvv after we get this working )

*Setting the bind address to * will forward connections on any interface and not just loopback ('lo' which includes == localhost ). ifconfig lists the interfaces.. i.e. eth0, lo, and wlan0.*

If that doesn't work troubleshoot:

Step 1) Make sure you are allowed to ssh into your remote machine:

On the remote machine itself try:

ssh localhost

If it says connection refused then you have to enable ssh on that machine.

If that succeeds, type ifconfig and note the local "inet 192.168.xxx.yyy" address.

Step2) try SSH from local machine

Next go to a machine on the same local network as your remote machine and try to ssh into your remote machine: ssh mylgoinID@192.168.xxx.yyy

If that doesn't succeed then check your remote machine's firewall ( see below ).

If that succeeded then

Step 3) Try ssh from middleman machine

log into the middleman machine and try an ssh connection directly from there. In the above case you've run ssh -R *:9300:localhost:22 middleuser@middleserver on the remote machine so you need to log in to the middlemachine and run: ssh remoteuser@localhost -p 9300

If that succeeds then the problem may be with a firewall on your server:

Before messing with iptables check and see if you've got a firewall manager in use. For example check if "ufw" is in use: sudo ufw status . It would be much easier to use ufw than to mess with iptables directly.

iptables -L and check if port 9300 is open ( this will involve some research of iptables.. it's NOT straightforward). Cheat: If port 9300 is listed next to http and in a similar way then check if http is open. If 9300 is listed below then it may not be reached if a "deny all"-type directive is listed before it. It also may be listed as a named port. cat /etc/services | grep 9300 however doesn't bring up a name in this case

Step 4) Try your login again:

ssh remoteuser@middleserver -p 9300
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.