4

What works

I have the following setup:

server <-NAT-> VPS <-> client

I have set up ssh to my server through a reverse tunnel and the following settings:

  • on VPS,

GatewayPorts yes

  • on server:

autossh -f -M 57575 -N -R <VPS ip>:9991:localhost:<server ssh port> vps

With this setup, I can simply ssh -p 9991 <server user>@<VPS ip> and log into my server from the client.

What doesn't

  • on VPS,

GatewayPorts yes, and otherwise identical setup to SSH case

  • on server:

autossh -f -M 57576 -N -R <VPS ip>:9992:localhost:8988 vps

python -m http.server 8988 to start the http server. I can confirm it binds to 0.0.0.0 and I can access it on the local machine.

However, when I try to access the website via http://<VPS ip>:9992 I get an ERR_EMPTY_RESPONSE.

Looking at netstat, the two situations seem identical. On VPS:

tcp 0 0 0.0.0.0:9992 0.0.0.0:* LISTEN -

tcp 0 0 0.0.0.0:9991 0.0.0.0:* LISTEN -

On server:

tcp 0 0 0.0.0.0:8988 0.0.0.0:* LISTEN 21003/python

tcp 0 0 0.0.0.0:<ssh port> 0.0.0.0:* LISTEN 550/sshd

tcpdump shows that a connection is established with port 9992 on the VPS, but nothing reaches port 8988 on server. The connection is FINned immediately on the VPS.

Why doesn't this work, when the exactly analogous SSH situation does?

  • 1
    You should start the server first and then initiate the remote port forwarding. Not the other way round. It also depends what your http.sever does (sending empty responses?). – Jakuje May 10 '17 at 10:10
  • Well, that was easy. Starting the server first worked. Thanks. I'm curious, though, why does that make a difference? Who keeps the "server started first" state, and how? – shmo May 10 '17 at 15:40
  • That was the same question I was asking myself when I posted the comment, but unfortunately I don't know the answer yet. – Jakuje May 10 '17 at 15:44
  • It must be that SSH checks that the destination port is open when opening the tunnel, and if it's not sets up the empty response failure mode. This seems somewhat strange, but maybe there are security reasons for this. – shmo May 10 '17 at 19:05
  • Most probably yes. Unfortunately I don't have a time to investigate that further. Good to see that it resolved your problem. – Jakuje May 11 '17 at 7:31
1

You should start the server first and then initiate the remote port forwarding. Not the other way round.

I am not sure why is that, but obviously it resolves the issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.