Remote port forwarding is created with -R parameter.

ssh -R source_port:forward_to_host:destination_port via_host 

This command connects to via_host. via_host runs a SSH server. It then forwards all connection attempts to source_port on the remote via_host machine to destination_port port on the local machine (a machine that initiated the ssh command) . forward_to_host machine must be reachable from the the local machine machine. Forwarding can be also done through Unix sockets.

Is destination_port port necessary on the machine that initiated the ssh command?

Isn't destination_port port on machine forward_to_host instead?

Isn't forward_to_host not necessarily the machine that initiated the ssh command?

Isn't the only requirement on forward_to_host is that it must be any machine reachable from the machine that initiated the ssh command?



Unfortunately all the examples in the documentation you link to forward to localhost, and it appears the description of -R is restricted to that. You’re correct in thinking that this isn’t an inherent limitation:

  • destination_port doesn’t have to be on the host where ssh is run;
  • destination_port is indeed on forward_to_host;
  • forward_to_host isn’t necessarily the host where ssh is run.

The whole point of -R is to allow a remote system to connect to any other system which is reachable from the initiating host. It’s the opposite of -L. The target host can be the initiating host itself, but it can also be useful to use this for other hosts — e.g. when a reverse tunnel is required for confidentiality, or when the initiating system is inside a network which the remote system can’t access directly.

  • It's maybe worth noting that source_port is only reachable on localhost on via_host, unless the server has GatewayPorts enabled. – Stephen Harris Feb 5 at 19:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.