I'm running 4 splunk indexers and I have to connect to it on port 9997. I have no direct line of sight or any way of routing to these splunk servers other than reverse ssh portforwards which I can connect to on,, and

How can I trick my linux machine (sles 11 SP4) into thinking:

  • ->
  • ->
  • ->
  • ->

I've got an output rule

   51  3060 DNAT       tcp  --  *      *         tcp dpt:9997 to:

which works, but the response I get is garbage

14:37:23.425219 IP > S 2063729062:2063729062(0) win 14600 <mss 1460,sackOK,timestamp 1532158690 0,nop,wscale 5>
14:37:23.425243 IP > S 2663988489:2663988489(0) ack 2063729063 win 32768 <mss 16396,sackOK,timestamp        1532158690 1532158690,nop,wscale 5> 
14:37:23.425249 IP > R 2063729063:2063729063(0) win 0

and doesn't complete the socket the way it would if I connected straight to the port forward

14:38:33.822640 IP > S 2794569169:2794569169(0) win 32792 <mss 16396,sackOK,timestamp 1532176289 0,nop,wscale 5>
14:38:33.822649 IP > S 1241947612:1241947612(0) ack 2794569170 win 32768 <mss 16396,sackOK,timestamp 1532176289 1532176289,nop,wscale 5>
14:38:33.822655 IP > . ack 1 win 1025 <nop,nop,timestamp 1532176289 1532176289>
14:38:33.822991 IP > F 1:1(0) ack 1 win 1025 <nop,nop,timestamp 1532176289 1532176289>
14:38:33.825172 IP > . ack 2 win 1024 <nop,nop,timestamp 1532176290 1532176289>
14:38:33.835115 IP > F 1:1(0) ack 2 win 1024 <nop,nop,timestamp 1532176292 1532176289>
14:38:33.835138 IP > . ack 2 win 1025 <nop,nop,timestamp 1532176292 1532176292>
  • Is is possible to use dns names instead of ip addresses? – John May 4 '18 at 20:16
  • @John negatory, I'm in a tiny subnet on a server that is only accessible via SSH. But I would like to know how using dns names might help. – Peter Turner May 4 '18 at 20:19

If you can use dns or host names, it would be possible to do the following

  1. open the ssh with reverse tunneling (best to use a keyed ssh connection for system automation)
  2. after the tunnel is established, add the host name entries to the /etc/hosts file but point them at
  3. when the tunnel goes down, remove those entries from the /etc/hosts file.

Step 1 is pretty straight forward, lots of examples are available.
Step 2 and 3 are not as straight forward, but are easy enough

At a high level, use a cron triggered script, look at the output from netstat to determine if you have active reverse connections and then re-write your host file with sed or awk to point to the proper address.

If host names aren't really workable, it might be possible to re-define your remote tunnel setup to use 127.0.0.x rather than 1 and spread your ports around.

something like

ssh credentials -NT -R 
  • Heh, I think this was what I was going to do initially (I was going to do it by IP, but hostnames might be useful). But you mean using tunnel interfaces, right? I probably will go back to this method if I can't get any more traction here. – Peter Turner May 4 '18 at 20:29
  • My answer saved before I was finished. Based on your comment, the second option might work better. – John May 4 '18 at 21:18
  • That doesn't work because of debug1: Remote: Forwarding listen address "" overridden by server GatewayPorts thinking there's a reason on these machines I can't change that... – Peter Turner May 4 '18 at 21:32
  • Check the remote server's /etc/ssh/sshd_config for the state that AllowTcpForwarding is in. It may be necessary to create a per-user override section for the connection user and allow it. – John May 4 '18 at 21:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.