I have a NAS running Linux behind a firewall at home. I want to access it remotely using a few services such as a Transmission GUI (port 9091) and webmin (port 10000), but through an SSH tunnel on port 22.

For simplicity, I wanted to leave as many net-facing ports closed and only opened up port 22 to the NAS.

I tried configuring tunnelling in PuTTY (local port 10000, remote.ip.address:10000), but I believe I'm still hitting a firewall rule after a successful SSH login. Is this the correct use of SSH tunnelling?

  • You haven't quite given enough information for us to say whether you are using it correctly or not. It can certainly do what you are trying to accomplish. You say you are "hitting a firewall rule". That makes me think you are trying to connect to the remote machine directly instead of using the port forwarded locally. Can you be more descriptive about your steps and the error your get? – Caleb Aug 5 '11 at 7:54

You don't need to open tunneled ports on the firewall. You are fine opening only the SSH port.

You may be getting caught by one of a few problems.

  • The local ports may already be in use. Try using netstat to see if the port is occupied.
  • When you connect to the tunneled port you will find it a localhost ( not the remote address. Some software may not like this.
  • Tunneling can be turned off in the server. In that case your tunnels won't work.
  • If you are tunneling to another host (remote.ip.address is not on the host you are tunneling through), you may be blocked by the SSH server's AllowTcpForwarding setting.
  • If you are tunneling to a port on the same host (remote.ip.address is, or some other IP on the server) you are tunneling to the destination software may not like it. For example, some VNC servers default to preventing same host connections to prevent looping conditions.

Try connecting with the debug flag enabled.


When I need to tunnel in past a firewall to get to a voip phone that I need to log into, I use this:

putty.exe -ssh username@publicip -pw password -L localport:privateip:destinationport

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.