I need reverse port forwarding via SSH to my server, such that on the server I can connect to a localhost port, which then is forwarded using the SSH tunnel to my local server.

My local system is windows, remote system Linux. When opening the tunnel using plink with standard password authentication, it works pretty good:

>plink.exe -R *:62050: [email protected]

Result on remote machine looks good and forwarding also works fine.

[user@host ~]$ netstat -an | grep 62050
tcp        0      0   *                   LISTEN
tcp        0      0 ::1:62050                   :::*                        LISTEN

I however want to use that as a pre-debug command in my IDE to establish the tunnel, so I want to use my private key:

>plink.exe -R *:62050: [email protected] -i C:\Users\abcdefg\.ssh\id_my.ppk

Connection also works great, I am not asked for a password and connection succeeds. However, there is no port opened:

[user@host ~]$ netstat -an | grep 62050

just returns an empty result. I can make the same observations when using the putty graphical interface. Remote tunnelling works like a charm using plain password auth, as soon as I am introducing a private key file, the connection is established, but the reverse tunnel is not.

How can I solve this?

  • maybe it is just the parameters order, put [email protected] in the last position
    – Emmanuel
    Commented Feb 19, 2014 at 23:20
  • @Emmanuel: Thanks for your answer. I tried to put the user@server part at the end. The connection is successful, however, there still is no port opened at the remote server.
    – Daniel
    Commented Feb 20, 2014 at 8:43
  • I was not able to reproduce, it worked in both case. Are you running the last putty version. chiark.greenend.org.uk/~sgtatham/putty/download.html
    – Emmanuel
    Commented Feb 20, 2014 at 16:26

1 Answer 1


The -v option will gives you more information on the client side.

plink.exe -v -R *:62050: user@host -i ./np.ppk
Looking up host "host"
Connecting to 135.x.x.x port 22
Server version: SSH-2.0-OpenSSH_5.1
Using SSH protocol version 2
We claim version: SSH-2.0-PuTTY_Release_0.63
Opened main channel
Requesting remote port *:62050 forward to
Remote port forwarding from *:62050 enabled              <---<<<
Allocated pty (ospeed 38400bps, ispeed 38400bps)
Started a shell/command

If you didn't manage to find the answer with plink verbose mode. Open sshd in debug mode on another port (or ask the root administrator to do that).
No need to stop the regular sshd deamon.

# /usr/sbin/sshd -dd -p  2222
debug2: load_server_config: filename /opt/ssh/etc/sshd_config
debug2: load_server_config: done config len = 514
debug2: parse_server_config: config /opt/ssh/etc/sshd_config len 514
debug1: Config token is port
debug1: Config token is protocol
debug1: Config token is hostkey
debug1: Config token is hostkey

Then connect to that sshd instance with plink option -P

plink.exe -v -P 2222 -R *:62050: user@host -i ./np.ppk

You will have the debug information of both end.


The solution is in man sshd at the "AUTHORIZED_KEYS FILE FORMAT" chapter.

It is likely that the no-port-forwarding option has been associated to your key but that no global option has been set.

         Forbids TCP forwarding when this key is used for authentication.  Any port forward requests by the client will return
         an error.  This might be used, e.g. in connection with the command option.

You should have access to your home ~/.ssh/authorized_keys , edit the file and remove that option.

Sometimes the authorized_keys are centralized in a protected directory in that case you will not be able to change it.

  • thanks for your detailed explanation. -v using the key results in the message: "Remote debug message: Server has disabled port forwarding.", and the port forwarding is refused. However, the same server, without private key results in "Remote port forwarding from *:62050 enabled.". So what can cause the forwarding to be refused with key?
    – Daniel
    Commented Feb 20, 2014 at 20:23
  • @waza-ari just made an update
    – Emmanuel
    Commented Feb 21, 2014 at 18:54
  • Thank you very much! I forgot an old gitlab installation on that server, which required the no-port-forwarding option for the ssh keys. Removed that old stuff from config and it finally worked. Unfortunately I cannot upvote yet.
    – Daniel
    Commented Feb 22, 2014 at 8:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .