i hope someone could help me because i can't get any further:

I have the follwing Setup:

System 1: PC Windows ( System 2: PC Ubuntu (

On the Ubuntu System i opened a ssh connection to a vpn provider,

localport on the Ubuntu System is 5080 remote Port of the VPN Provider is 3128 (http Proxy):

ssh -N -oUserKnownHostsFile=perfect_privacy_known_hosts -L 5080: -v [email protected]

If i use Firefox with with Foxy Proxy on the Ubuntu System and connect to localhost:5080, the traffic goes trough the ssl tunnel to the vpn provider an everhting works fine.

Now i want to connect from my Windows Client via Ubuntu Client to VPN Provider. So i made the same, on the Window Client i put in foxy Proxy the IP Address of the Ubuntu Client and the port 5080. But this won't work (i think because the ssh tunnel on the ubuntu clients listen on localhost and not

What will i have to do to make it works

Best regards sangul

1 Answer 1


Here's one way to do this.

  • While at it add the ExitOnForwardFailure=yes option

    ... to avoid keeping multiple ssh by mistake. Only the first of them that could open the port can handle the forwarded port anyway.

  • Alter the ssh command so it doesn't use anymore to listen

    • Either listen to instead

      ... by prepending this optional IP address to the -L parameter. That means Firefox Proxy will have to be updated to instead of .

      ssh -N -o ExitOnForwardFailure=yes -o UserKnownHostsFile=perfect_privacy_known_hosts -L -v [email protected]
    • or listen to

      ... to bind to the IPv4 INADDR_ANY wildcard address avoiding having to change Firefox Proxy settings especially if the Ubuntu host had a dynamic IP address and no known DNS.

      ssh -N -o ExitOnForwardFailure=yes -o UserKnownHostsFile=perfect_privacy_known_hosts -L -v [email protected]

    Note: The -g option (ie -o GatewayPorts=yes) has the same effect as just above except it also binds to the in6addr_any ( :: ) address, so an IPv6 access would also be unrestricted without an IPv6 firewall: better avoid -g here.

  • Optional: restrict access using iptables. This can be completely omitted if not needed.

    Since OP added the tag, also allow only the host itself and to access this port. (Almost) don't affect any other access because this was not asked by OP and this would really start to become off-topic.

    I'm considering there's currently no iptables (nor UFW/firewalld) in place. Consider updating the tool providing iptables rules if such tool is present instead. The rules below should be first for them to work properly, so I'm using -I + number (to keep ascending order) instead of -A to allow them to be prepended before rules added before by a possible firewalling tool, but this won't help much for an automatic setup at boot.

    iptables -I INPUT 1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
    iptables -I INPUT 2 -i lo -j ACCEPT
    iptables -I INPUT 3 -m conntrack --ctstate INVALID -j DROP
    iptables -I INPUT 4 -p tcp -s --dport 5080 -j ACCEPT
    iptables -I INPUT 5 -p tcp --dport 5080 -j REJECT --reject-with tcp-reset

    This allows previous connections to continue, anything from the host itself and then only allow access to port 5080 from

    Note: The ... INVALID -j DROP is mandatory in presence of a REJECT rule (see this commit for technical details).

  • Hello A.B, thank you soo much!! The way you described works !
    – sangul
    Dec 14, 2021 at 18:27
  • Hello A.B, thank you soo much!! The way you described works ! Thank you also for the detailed information, especially for the iptables rule set. I can use them for the setup! Have a nice day and best regards sangul
    – sangul
    Dec 14, 2021 at 18:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .