What works

I have the following setup:

server <-NAT-> VPS <-> client

I have set up ssh to my server through a reverse tunnel and the following settings:

  • on VPS,

GatewayPorts yes

  • on server:

autossh -f -M 57575 -N -R <VPS ip>:9991:localhost:<server ssh port> vps

With this setup, I can simply ssh -p 9991 <server user>@<VPS ip> and log into my server from the client.

What doesn't

  • on VPS,

GatewayPorts yes, and otherwise identical setup to SSH case

  • on server:

autossh -f -M 57576 -N -R <VPS ip>:9992:localhost:8988 vps

python -m http.server 8988 to start the http server. I can confirm it binds to and I can access it on the local machine.

However, when I try to access the website via http://<VPS ip>:9992 I get an ERR_EMPTY_RESPONSE.

Looking at netstat, the two situations seem identical. On VPS:

tcp 0 0* LISTEN -

tcp 0 0* LISTEN -

On server:

tcp 0 0* LISTEN 21003/python

tcp 0 0<ssh port>* LISTEN 550/sshd

tcpdump shows that a connection is established with port 9992 on the VPS, but nothing reaches port 8988 on server. The connection is FINned immediately on the VPS.

Why doesn't this work, when the exactly analogous SSH situation does?

  • 1
    You should start the server first and then initiate the remote port forwarding. Not the other way round. It also depends what your http.sever does (sending empty responses?).
    – Jakuje
    May 10, 2017 at 10:10
  • Well, that was easy. Starting the server first worked. Thanks. I'm curious, though, why does that make a difference? Who keeps the "server started first" state, and how?
    – shmo
    May 10, 2017 at 15:40
  • That was the same question I was asking myself when I posted the comment, but unfortunately I don't know the answer yet.
    – Jakuje
    May 10, 2017 at 15:44
  • It must be that SSH checks that the destination port is open when opening the tunnel, and if it's not sets up the empty response failure mode. This seems somewhat strange, but maybe there are security reasons for this.
    – shmo
    May 10, 2017 at 19:05
  • Most probably yes. Unfortunately I don't have a time to investigate that further. Good to see that it resolved your problem.
    – Jakuje
    May 11, 2017 at 7:31

1 Answer 1


You should start the server first and then initiate the remote port forwarding. Not the other way round.

I am not sure why is that, but obviously it resolves the issue.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .