If I ssh root@server -R 5901:localhost:5900 and netstat -an I get:

Active Internet connections (servers and established)                                           │
Proto Recv-Q Send-Q Local Address           Foreign Address         State                       │
tcp        0      0*               LISTEN                      │
tcp6       0      0 ::1:5901                :::*                    LISTEN                      │

Whereas if I allow GatewayPorts yes in my ssh_config and do the same I get

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0  *               LISTEN
tcp6       0      0 :::5901                 :::*                    LISTEN

(and my service is reachable from the outside network)

How do you read the format ::1:5901 (as opposed to :::5901)?

edit :

How do you read that one is not open to the public network? means "all IP addresses on the local machine"


In IPv6 terminology, ::1 is the loopback address (e.g. in IPv4 terminology).

It is essentially 0:0:0:0:0:0:0:1 (or more precisely, but uninterestingly, 0000:0000:0000:0000:0000:0000:0000:0001) with all the 0's collapsed down into ::1. It is functionally equivalent to the IPv4 and performs the same role.

So in the first output, the tcp6 line is listening on the IPv6 loopback address, not on all addresses, and hence is not visible externally.

The second example (:::5901) shows the unspecified IPv6 address ::, followed by an additional colon and the port number. This is functionally equivalent to the unspecified IPv4 address with port in and hence is open to the network over any IPv6 address.

  • excellent ! makes sense.. do you have a fetish/preferred book on those issues by any chance ? – nicolas Mar 7 '16 at 14:44
  • @nicolas no, IPv6 is horrible and reading about it is like putting salt into your eyes. However, the Wikipedia overview is usually helpful for the basics. – EightBitTony Mar 7 '16 at 14:46
  • (Just a comment, as this was edited out: Presenting an IPv6 address with all those leading zeros is not "more precisely", but not recommended. RFC 5952, section 4.1 says quite strictly, "Leading zeros MUST be suppressed." :-) While this verbose form must be accepted by any software that handles IPv6 addresses, it must not be used in textual representations.) – Dubu Mar 7 '16 at 16:15
  • @EightBitTony ahah :) There are fine and precious japanese salts though... but I guess you dont want it in your eyes :) thanks for the tip, i was disoriented with many other things to have the good reflex... – nicolas Mar 7 '16 at 17:07
  • @Dubu good to know – nicolas Mar 7 '16 at 17:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.