Its an answer I got from questioning about port forwarding but I'm not sure what it means..

$ ssh lab_desktop -L 2200:lab_server:22 -vvv

my wild guess:

first get connect to lab_desktop and then again log into lab_server(port 22) and the received data from this connection will be forwarded to lab_desktop, port 2200.

is my wild guess right??

but I still don't understand what that '-vvv' means...

update after applying answer:

okay with creek's helpful answer&comments, I did what I can to make creek's answer work

again, let me be clear with the terminologies

mypc - the one that's doing all the typing

lab_desktop - ssh server

lab_server - final destination that I want to communicate with. This server will only allow connection from lab_desktop. And one more thing: it will only allow connections through port 122.

okay since logging in to lab_desktop and lab_server requires username and password, I just made rsa authentication for mypc--lab_desktop and lab_desktop--lab_server so that I wouldn't confront the trouble of entering the password all the time and just to set aside the possibility of password entering making the ssh command more complex.

After that I used the command:

ssh Black@lab_desktop -v -L 2200:lab_server:122

the below is the output

chulhyun@chulhyun-Inspiron-3420:~/.ssh$ ssh Black@$labcom -v -L 2200: 
OpenSSH_5.9p1 Debian-5ubuntu1.4, OpenSSL 1.0.1 14 Mar 2012
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to [] port 22.
debug1: Connection established.
debug1: identity file /home/chulhyun/.ssh/id_rsa type -1
debug1: identity file /home/chulhyun/.ssh/id_rsa-cert type -1
debug1: identity file /home/chulhyun/.ssh/id_dsa type -1
debug1: identity file /home/chulhyun/.ssh/id_dsa-cert type -1
debug1: identity file /home/chulhyun/.ssh/id_ecdsa type -1
debug1: identity file /home/chulhyun/.ssh/id_ecdsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1
debug1: match: OpenSSH_6.6.1 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1.4
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA 79:64:5d:e7:ac:78:b7:52:3d:9a:6a:3b:c1:37:a0:2d
debug1: Host '' is known and matches the ECDSA host key.
debug1: Found key in /home/chulhyun/.ssh/known_hosts:1
debug1: ssh_ecdsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Trying private key: /home/chulhyun/.ssh/id_rsa
debug1: read PEM private key done: type RSA
debug1: Authentication succeeded (publickey).
Authenticated to ([]:22).
debug1: Local connections to LOCALHOST:2200 forwarded to remote address
debug1: Local forwarding listening on ::1 port 2200.
debug1: channel 0: new [port listener]
debug1: Local forwarding listening on port 2200.
debug1: channel 1: new [port listener]
debug1: channel 2: new [client-session]
debug1: Requesting [email protected]
debug1: Entering interactive session.
debug1: Sending environment.
debug1: Sending env LANG = ko_KR.UTF-8
Last login: Tue Jun 24 16:47:27 2014 from

Black@Black-PC ~

its long but I guess the only thing that I should be looking is the lines:

debug1: Local connections to LOCALHOST:2200 forwarded to remote address
debug1: Local forwarding listening on ::1 port 2200.

when I use my netstat to see if this is true(netstat -tulpn | grep 2200) the output is :

root@chulhyun-Inspiron-3420:/etc/ssh# netstat -tulpn | grep 2200
tcp        0      0*               LISTEN      14966/ssh       
tcp6       0      0 ::1:2200                :::*                    LISTEN      14966/ssh 

so I guess the ssh hopping is established after all..

The problem now is when I try to use the port 2200 in mypc. As Creek suggested, I need to exploit this port so I tried logging in with both my root account and user account but the result was a failure due to password..

chulhyun@chulhyun-Inspiron-3420:~$ su
root@chulhyun-Inspiron-3420:/home/chulhyun# ssh root@localhost -p 2200
root@localhost's password: 
Permission denied, please try again.
root@localhost's password: 

root@chulhyun-Inspiron-3420:/home/chulhyun# exit
chulhyun@chulhyun-Inspiron-3420:~$ ssh chulhyun@localhost -p 2200
chulhyun@localhost's password: 
Permission denied, please try again.

The passwords are the right ones I'm sure of it. But I don't understand why it won't work...

I come up to this point. Could you help be reach further?


the new problem that I'm facing is discussed and solved at: Linux can't recognize the right password when ssh'ing?

3 Answers 3


ssh lab_desktop -L 2200:lab_server:22 -vvv

  1. ssh lab_desktop - create an ssh connection to lab_desktop as $USER
  2. -L 2200:lab_server:22 - using the connection to lab_desktop, forward port 2200 on the local machine to port 22 on lab_server
  3. -vvv - enable the maximum verbosity level

This command will open a socket on your local machine on port 2200, then using an SSH tunnel, all traffic sent to port 2200 on localhost will be FORWARDED to port 22 on lab_server.

To utilize your forwarded port and establish an SSH connection to lab_server, you'll need to initiate a second connection where you connect to the local port on localhost:

ssh user@localhost -p 2200
  • at '2.' what does it mean 'foward port 2200 on local machine to port 22 of lab_server?? at this point does local machine=lab_desktop or localhost(the computer that I'll be typing into)?
    – kwagjj
    Commented Jun 24, 2014 at 2:14
  • 1
    local machine = the machine you initiated the connection from, e.g. localhost
    – Creek
    Commented Jun 24, 2014 at 2:16
  • when I'm logging in to lab_desktop and lab_server I need to specify the username and password... so when I type 2200:lab_server:22 I noticed that it wouldn't accept command input like: 2200:[email protected]:22 how can I specify the username too?
    – kwagjj
    Commented Jun 24, 2014 at 2:24
  • 1
    @kwagjj see updated answer
    – Creek
    Commented Jun 24, 2014 at 2:34
  • hmm.. I think your explanation is colliding with polym's explanation. First I think we should be clear on the terminology of the three players here: there are mypc lab_desktop lab_server. mypc is the computer that I would be typing in the commands. I have understood your answer as : mypc's port 2200 is connected with port 22 of lab_server. but poylm's answer seems to say: mypc will login to lab_desktop and from there with 2200:lab_Server:22 command, any data received from port 22 of lab_server will be forwarded to port 2200 of lab_desktop. which explanation is right?
    – kwagjj
    Commented Jun 24, 2014 at 2:50
ssh -L 2200:lab_server:22 -vvv lab_desktop

will do the following:

It is being verbose on the maximum level (3), meaning it will print debug level 3 information. An example is:

debug3: channel 0: will not send data after close

The -L lets you tunnel your data via the given port 2200 on your side lab_desktop to the lab_server on port 22.

So if you connect to lab_desktop on port 2200, you will receive data from lab_server on port 22.

A good source about ssh port forwarding is here.

  • 1
    almost got it ;)
    – Creek
    Commented Jun 24, 2014 at 2:16
  • hehe :D. I like you
    – polym
    Commented Jun 24, 2014 at 2:17
  • 1
    :( I'm getting more and more confused... here's some more followup questions: 1. the order of the command is a little different from my original question. is this okay? 2. one problem I'm also facing is that when logging into lab_desktop and lab_server I need to speicify username and password. I think the command line won't be able to get the job done in one shot since I need to type in passwords and all that. How can I solve this?
    – kwagjj
    Commented Jun 24, 2014 at 2:21
  • 1. Well for most commands, it's always <cmd> <options> <essential arguments>, here ssh <options> <hostname>. Some or most programs will interpret anything after an <essential argument> as such. E.g. your -L might be seen as a command and therefore will produce you an error. 2. I think sshpass can help you there, it will give you the option to input your credentials.
    – polym
    Commented Jun 24, 2014 at 2:39
  • 1
    @polym I think public key auth is probably more appropriate
    – Creek
    Commented Jun 24, 2014 at 3:00


If the website is down you can run your own version


Extract from website

enter image description here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .