I have established a reverse ssh tunnel into a restricted network to an aws server, i.e. to access it, I ssh into the aws server and from there I get access to the machine in the restricted network on some custom port.

On this restricted network, there are devices which can be configured through a web browser.

I believe I could do something like ssh -R 8080:deviceIP:80 user@aws to get it forwarded to aws machine but then I still can't access it (other than through remote X which is terribly slow). How can I pipe deviceIP:80 through to my browser at home via aws?

I've tried the above ssh command and then directed the brower on my home computer to aws:8080 but that didn't load any page...


2 Answers 2


SSH tunnels are useful to cross insecure networks, providing end-to-end encryption when connecting two end points that seat on distinct networks.

A far as I can tell (thanks to comments), what you have is:

  • A local host-A: your localhost, on your local network (likely behind firewall/NAT)

  • A publicly reachable host-B: the aws server

  • A non-publicly reachable host-C: on the restricted remote network (likely behind firewall/NAT)

  • A non-publicly reachable host-D: the one you refer to as deviceIP, that listens on port 80 and is on the remote restricted network

If you want to connect your host A to host D, letting your browser reach it on port 80, you need:

  1. A tunnel from host-A to host-B, that:

    • Lets host-A listen on port 8080

    • Sends traffic from that port through the tunnel

    • On host-B (aws), redirects the traffic coming from the tunnel to the local (i.e. on host-B) port 15872 (I took it from your comments; you can choose any available port; just make sure to use the same one in all commands)

    # Execute on host-A
    $ ssh -L 8080:localhost:15872 user@host-B
  2. A tunnel from host-C to host-B, that:

    • Lets host-B listen on port 15872

    • Sends traffic from that port through the tunnel

    • On host-C (your Linux server), redirects that traffic to port 80 on host-D

    # Execute on host-C
    $ ssh -R *:15872:host-D:80 user@host-B

This way, requests made to host-A on port 8080 will be tunneled to host-B, redirected to port 15872 on the same host-B, tunneled to host-C and redirected on host-C to port 80 of host-D.

  • Ok, seems like I need something like $ ssh -L *:8080:deviceIP:80 user@localhost # run on awsonly that I don't have 'deviceIP' but instead a reverse tunnel on port '15872' to get access to the host in the restricted network.... so how do I need to modify this accordingly? Plus what do you mean by It's probably not the best way ? Is there a better way you know of?
    – stdcerr
    Nov 7, 2018 at 13:06
  • 1
    @cerr About "It's probably not the best way", see my edited answer.
    – fra-san
    Nov 7, 2018 at 13:17
  • 2
    @cerr Your network topology is not entirely clear to me. Are you actually trying to connect your host (A) to a non-directly reachable remote host (C) by establishing 2 different tunnels to a publicly available host (B)? As in "A -ssh> B <ssh- C"? If so, I'm sorry, I misunderstood your question - and I will update my answer.
    – fra-san
    Nov 7, 2018 at 13:22
  • Yes pretty much, what I have is (A being my private computer, B the public reachable aws instance, C the Linux host in the restricted network, D the device I would like to reach in the restricted network). What I have going fine is A-ssh>B-reverse ssh>C. What I would like to add: A-http8080>B-reverse ssh>C-http80>D.
    – stdcerr
    Nov 7, 2018 at 13:45
  • 1
    @cerr See edited answer.
    – fra-san
    Nov 7, 2018 at 14:49

You don't redirect a webserver to your browser - you would redirect requests from your browser to the webserver. It's a forward proxy, not a reverse one that you need.

This will create a listening socket on your client port 8080, and route that forwards across the ssh tunnel to deviceIP port 80:

ssh -L 8080:deviceIP:80 user@aws
  • But this won't forward requests sent to aws:8080 to deviceIP:80 - which is utltimately what I need.
    – stdcerr
    Nov 6, 2018 at 14:19
  • That's not what you asked
    – roaima
    Nov 6, 2018 at 14:21
  • 1
    You don't pipe anything to your browser. You create a pipe, that your browser can reach, that forwards to the webserver.
    – roaima
    Nov 6, 2018 at 14:24
  • 1
    @cerr What creating a tunnel with ssh -R 8080:deviceIP:80 user@aws does: 1) aws listens on port 8080 (by default, loopback interface only); 2) traffic from a connection made to aws:8080 is tunneled to your local host; 3) your local host forwards it to deviceIP:80.
    – fra-san
    Nov 6, 2018 at 14:58
  • 1
    @cerr I posted my own answer to clarify.
    – fra-san
    Nov 7, 2018 at 10:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.