I have a local machine A, and I want to access machine C that is behind a firewall. I have access to machine B, which is on the same network of C, and I want to use machine B as a ssh server to establish a tunnel between A and C.

Suppose we want to create two links between A and C. This can be achieved by port forwarding like

ssh -L IP_of_A:5000:IP_of_C:5000 -R IP_of_C:5001:IP_of_A:5001 IP_of_B

However, I prefer to use instead of the real IP address in the above command, because somehow my program breaks when using the real IP address in the above command. So I would like it to be like

ssh -L IP_of_A:5000: -R IP_of_C:5001: IP_of_B

But it seems that using this, the port been tunneled is between machine A and machine B, instead of machine A and machine C.

So how can we set the tunnel to be between A and C, and still using the in the ssh address?

I'm quick new to ssh, so if the question is not clear, please feel free to point it out and I will try my best to make it clear.

  • You cannot specify IP_of_C in -R IP_of_C:5001:IP_of_A:5001, that address (socket bind address) must be one of local adddresses of the remote host (B), otherwise * or blank.
    – yaegashi
    Aug 29, 2015 at 17:54

2 Answers 2


The address specified in -L is used by the remote host (B). So it's no wonder that you actually have a tunnel between A and B by -L 5000: When you are connecting to TCP port 5000 on A, the connection is forwarded to on B.

On the other hand -R 5001: would be fine because the address is resolved by the local host (A) and your destination is A. When you are connecting to TCP port 5001 on B, the connection is forwarded to on A.

Note that both -L/-R listening ports are bound to localhost by default, so they are available only from A and B respectively. If you want to allow other hosts to connect, add the bind_address part in -L / -R. Just adding a leading : would suffice:

ssh -L :5000:IP_of_C:5000 -R :5001: IP_of_B

with this set up A connects to and C connects IP_of_B:5001.

If you prefer to use on both A and C, you need to establish a (virtually) direct SSH connection between A and C, which is possible with SSH over SSH tunneling by ProxyCommand. Put the following in ~/.ssh/config:

Host C
ProxyCommand ssh -q -W IP_of_C:22 IP_of_B

Then connect to C from A with 1-hop ssh:

ssh -L 5000: -R 5001: C

This time you don't have to add bind_address part because is used for the tunnel connection in both ends.

  • I see your point thanks. Do you know what's the difference between using and the real IP address in ssh tunnel? Aug 29, 2015 at 14:14
  • @xslittlegrass updated my answer.
    – yaegashi
    Aug 29, 2015 at 17:45
  • Thanks a lot! That's very helpful. I'm wondering how would one could use more than one hosts to establish the virtually direct SSH connection. Aug 30, 2015 at 14:27

From what I understand, I think what you're looking for was answered on StackExchange's ServerFault site: here.

Since this deals more with networking, and network/server-administration tools that may be a better site to ask this sort of question in the future.

There they are talking specifically about setting up a tunnel for SSHing into host C from host A, but you can do it for any TCP connection.

In their example $PROXYHOST is host B, $REMOTEHOST is host C, and $SSHPORT is whatever port you want to send connections to on host C.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .