I think my question is much easier to understand looking at the draw below. The idea is that for some reasons (such like accessing the intranet of my company, or getting access to some web pages that only my company has access to) I want to browse the Internet using the IP of my company, but from home. The problem is that to get access to my PC "inside" I have to go through a gate.

One solution could be of course to login into gate, and from there to my PC, with ssh -X. Once inside I can open a Firefox window that will pop up in my PC at home. The problem of this approach is that it is very slow because I have to send the whole GUI through the network, instead of just the Internet packages.

A better idea to overcome this problem would be to use ssh -D8080 ip.remote.company to create a tunnel, and then setup Firefox in my PC at home to use the remote computer as proxy, sending the internet packages (but not the GUI) through this secure channel, such as explained in many web pages.

The problem, of course, is that I have to go through the gate, which adds a level of complexity, so I have to setup (I think) two tunnels instead of just one, those drawn in red in the figure.

How can I setup a port forwarding (or something similar) to tunnel my connection to Internet through the network of my company, as illustrated in the figure, from outside? Of course I have access and accounts in the three computers.


  • 1
    Ask your network admin for VPN access. – jordanm Nov 28 '12 at 23:48
  • Another note: On the slow ssh -X - using compression (ssh -C -X) might help a bit... VNC (if it is available on gate) over a tunnel is another option, but I still prefer my tunnel in the answers... – Gert van den Berg Dec 31 '15 at 6:34

Assuming a Unix-based source PC and gate... ssh -t -l gateuser -L7777: gate "ssh -l inside_user -D7778 -N inside_pc"

Then use localhost port 7777 as a socks proxy.

I would recommend using autossh to keep the connections up... that is probably another problem...

Explanation: From localhost, forward port 7777 to gate's port 7778. Assign a terminal, to allow you to answer ssh prompts. On gate, run the quoted ssh commend to run dynamic forwarding on gate's port 7778. (which is forwarded to the initial PC's 7777)


Try this approach. Add in you SSH client configuration file (e.g. ~/.ssh/config) the following configuration:

Host mypcinside
# replace with the IP of your PC in the local network
# as seen from the gate.
ProxyCommand ssh -q gate nc -q0 22
DynamicForward 8080

Host gate
# replace with real hostname
Hostname gate.mycompany.com

This will create a tunnel of a plain TCP connection port 22 to your pc through the gate and start an SSH connection as if you are on the gate. Use

$ ssh mypcinside

to connect.

One of the requirements is that the gate has nc installed (or replace with another netcat-like tool) and it allows you to start plain TCP port 22 connections without using the SSH client. In a standard configuration this is perfectly possible, but some enforced security might be in place to prevent this.

  • Although the solution by @Gert is the one I was looking for, I will try your suggestion as well. Thanks. – Onturenio Nov 29 '12 at 20:21
  • @Onturenio So what did you find? Did it work? – rootkea Feb 28 '17 at 14:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.