From a server, I'd like to reach a server on port 80. can reach, but can't reach (firewall).

I have set up a reverse proxy, by typing the following command on

ssh -f -N -T -R0.0.0.0:80:localhost:80

now can reach, with the following command:

wget localhost:80

However I'd like to be able to reach by taping


Is this possible, without messing with the DNS?

  • 1
  • @7171u ok thanks, I have added a rule so that iptables -t nat -L shows: DNAT tcp -- anywhere tcp dpt:http to: however, the second wget is still not working, what could be wrong?
    – rogerJ
    Commented Mar 1, 2016 at 14:32
  • I have used this on RHEL7 and it works fine.
    – jijinp
    Commented Mar 1, 2016 at 15:01

2 Answers 2


You need to define the GatewayPorts in sshd_config otherwise the * or will bind only to the loopback interface.

Also note that

Privileged ports can be forwarded only when logging in as root on the remote machine.

From manual page for ssh:

By default, TCP listening sockets on the server will be bound to the loopback interface only. This may be overridden by specifying a bind_address. An empty bind_address, or the address ‘*’, indicates that the remote socket should listen on all interfaces. Specifying a remote bind_address will only succeed if the server's GatewayPorts option is enabled (see sshd_config(5)).

  • I have added the following line in /etc/ssh/sshd.config -> GatewayPorts clientspecified. However it still doesn't work.
    – rogerJ
    Commented Mar 1, 2016 at 16:12
  • Also I would try with * or address of outer interface ( instead of and I would watch for errors on both connections.
    – Jakuje
    Commented Mar 1, 2016 at 16:27
  • I tried both * and, to no success. I don't really know what errors to look for, the only thing I can tell you is that the tunnel itself works (wget localhost:80), as explained in the question, so the error is probably not coming from here. What doesn't work is just the wget, which is maybe an error with the iptables rule
    – rogerJ
    Commented Mar 1, 2016 at 16:42
  • Why do you try wget You should try wget This is where your port is forwarded, isn't it?
    – Jakuje
    Commented Mar 1, 2016 at 16:54
  • Well that's the whole point of my question. Say the server I would like to access is google.com, but I can't reach it directly, though google.com can reach me, I'd like to set up my network so that I can reach google.com transparently without having to change anything. So in the end of this configuration, I expect to be able to type wget google.com, not wget localhost or wget, which is my own ip.
    – rogerJ
    Commented Mar 1, 2016 at 17:06

I was struggling with this issue on Ubuntu 14.04 (I tried both GatewayPorts clientspecified and GatewayPorts yes in /etc/ssh/sshd_config).

Instead, adding this to my sshd_config worked:

Match User !root
    GatewayPorts yes

That is, I had to specify a user to match the rule to.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .