I am experimenting a bit with ssh port forwarding and I stumbled upon a confusing thing. It seems to me that the following commands are doing the same thing:

ssh -NfL vm2.local
ssh -NfL vm2.local
ssh -NfL localhost

Connecting to pots 2222, 2223 and 2224 from pc brings me all to vm2.local.

$ ss -antp # on vm1.local (
State      Recv-Q Send-Q        Local Address:Port          Peer Address:Port 
LISTEN     0      128                     *:*      users:(("ssh",10170,4))
LISTEN     0      128                     *:*      users:(("ssh",10178,4))
LISTEN     0      128                     *:*      users:(("ssh",10225,4))
LISTEN     0      128                       *:22                       *:*      users:(("sshd",836,3))

What is the difference between the above commands? Is the tunnel created somewhat different? The first command is correct according to man pages, the second is from some website and the last is error I made that turned out working too.

  • Are vm2.local and localhost the same machine? – cutrightjm Dec 5 '15 at 3:30
  • Have you tried directly using the IP address instead of the hostname? @ekaj may be right. – Gene Dela Rosa Dec 5 '15 at 6:54
  • vm2.local and localhost being the same, those are indeed, the same exact command, you'll connect local port 2222 to 2224 to 22 on localhost. – Archemar Dec 5 '15 at 8:46
  • see my more complete answer on port forwarding : unix.stackexchange.com/questions/237904/… – Archemar Dec 5 '15 at 8:47
  • @ekaj The vm1.local and vm2.local are virtual machines on the network. HOST:, vm1.local:, vm2.local – NefariousOctopus Dec 5 '15 at 10:52

There IS difference, even though it does not matter in your case. I am not good in drawing, so I will try to describe it with words:

  1. ssh -NfL vm2.local

    This makes encrypted connection between your host and vm2.local and the port is forwarded through this secure channel, because every end (local and remote) binds its local IP address.

  2. ssh -NfL vm2.local

    This is the same like above, but you don't bind address of public network interface, but the local one ( For ssh port, there is no difference (it listens on both of them), but it matters for services listening only on localhost (for example mysql).

  3. ssh -NfL localhost

    This one is connecting to your local host securely (basically no security effect) and then binds remote host directly, so everything you write to the port 2224 is send directly between the machines unencrypted (no problem here for SSH connections, but it would matter for different type of traffic).


You should learn to use the second case, but when the forwarded port is not needed to be accessible from outside, you should always bind localhost on local side, like this:

ssh -NfL localhost:2223:localhost:22 vm2.local

where the localhost is default, so you can boil it down to

ssh -NfL 2223:localhost:22 vm2.local
  • So if I get it right it means ssh -NfL <to_what_addres_to_bind_on_local_machine>:<local_machine_port>:<to_what_addres_to_bind_on_remote_machine>:<remote_machine_port> <remote_machine>. – NefariousOctopus Dec 5 '15 at 11:00
  • exactly. This is also in manual page, but in more complicated way. – Jakuje Dec 5 '15 at 11:01
  • Now whole universe makes sense again! :) Thank you :) – NefariousOctopus Dec 5 '15 at 11:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.