I'm running this command on myServer:

ssh -g -p 9922 -f myuser@serverOnOpenInternet -L 1212:serverBehindFirewall:80 -N

serverOnOpenInternet runs sshd on port 9922. (not my call)

Once I run the command in question on myServer, I can do:

wget http://localhost:1212/

and successfully reach the index page of serverBehindFirewall.

BUT: if I try from another machine to hit:

http://myServer:1212/

The connection times out and I can't connect through the tunnel to serverBehindFirewall.

I've tested the -g switch on my mac and verified that it works like I'd expect from there. I know these are different versions/implementations of ssh. But from everything I can glean, ssh on Ubuntu 14.04 should support the -g switch as well. (it's mentioned in the man page)

Please help :)

  • Perhaps you have a firewall on myserver which prevents access to port 1212? – Lambert Jun 23 '15 at 11:48
  • @lambert it's a pretty standard ubuntu 14.04 LTS install.. but I will double check .. – YitzJacob Jun 23 '15 at 12:10
  • 1
    Could you check which interface 1212 is bound on, paste the output of ` netstat -ntl |grep 1212` – X Tian Jun 23 '15 at 12:20
  • 1
    tcp 0 0 0.0.0.0:1212 0.0.0.0:* LISTEN that's my ssh tunnel connection that I've opened. – YitzJacob Jun 23 '15 at 12:27
  • And the client is able to resolve myserver? I do think so because you will have a message indicating the host couldn't be resolved instead of the timeout message you are receiving but to double check... – Lambert Jun 23 '15 at 12:34
up vote 0 down vote accepted

You may need to specify a bind address on the -L option. Like:

-L 192.168.1.100:1212:serverBehindFirewall:80

as requested, paste from below:

Option "GatewayPorts" set to "yes" in /etc/ssh/ssh_config fixed the problem.

This obviously does (almost) the same, as specifying "GatewayPorts yes". It binds to the specified address. The Option "GatewayPorts yes" automatically binds to the wildcard address (0.0.0.0), enabling remote clients to connect. If not specified, and no IP-Address is used to bind to (-L : : : ) , then only the loopback address 127.0.0.1 is bound, so no remote hosts can connect

  • Sorry, and that address should be what? The address of serverBehindFirewall, serverOnOpenInternet or myServer ? – YitzJacob Jun 23 '15 at 11:43
  • :) Of course it is the address of the machine providing the tunnel ... – gerhard d. Jun 25 '15 at 6:57
  • This obviously does (almost) the same, as specifying "GatewayPorts yes". It binds to the specified address. The Option "GatewayPorts yes" automatically binds to the wildcard address (0.0.0.0), enabling remote clients to connect. If not specified, and no IP-Address is used to bind to (-L <IP> : <LOCAL_PORT> : <REMOTE_IP> : <REMOTE_PORT> ) , then only the loopback address 127.0.0.1 is bound, so no remote hosts can connect. – gerhard d. Jun 25 '15 at 7:38
  • Thanks for clarifying! Ok, Along with your comment for explanation this would be a complete answer :) so please add this info to your answer including GatewayPorts yes and I can mark yours as the correct answer. – YitzJacob Jun 26 '15 at 13:12

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.