Add port forwarding to a running SSH session

Question

The OpenSSH client has a command line option for port forwarding, used like this:

ssh -L localport:server:serverport user@host

which will connect to host as user, and at the same time redirecting localport on the client to serverport on server (which can be host or anything reachable from host over the network).

Now suppose I have SSHed into host doing just

ssh user@host

and in the middle of the session I realize I forgot to forward the port. Alas, I am in the middle of something, so I don’t just want to log out and re-establish the SSH connection with the port forwarding.

Is there a way to add port forwarding to a running SSH session?

Answer 1

From man 1 ssh:

ESCAPE CHARACTERS

When a pseudo-terminal has been requested, ssh supports a number of functions through the use of an escape character.

A single tilde character can be sent as ~~ or by following the tilde by a character other than those described below. The escape character must always follow a newline to be interpreted as special. The escape character can be changed in configuration files using the EscapeChar configuration directive or on the command line by the -e option.

The supported escapes (assuming the default ~) are:

[…]

~C
Open command line. Currently this allows the addition of port forwardings using the -L, -R and -D options (see above). […] Basic help is available, using the -h option.

So type Enter~C (i.e. capital c), then

-L localport:server:serverport

with desired localport, server and serverport, finally Enter.

Notes:

• The initial Enter will be immediately sent to the remote side and may cause some action there, so pick a good moment (e.g. when you're in a shell with an empty command line). Or if you are sure the last thing you have typed is Enter anyway (e.g. you have just invoked a command that is now running), you can start directly with ~ because Enter has already been noticed by your local ssh.

• On internationalized keyboards the tilde could be a dead key for generating special 'tilded' characters (like pressing ~n to generate ñ). In that case, it could be necessary to press SPACE after ~ to generate a single tilde, i.e: ENTER~SPACEC. In the case of the Spanish/LA keyboard layouts, as there is no combined character using tilde and C, the space can be omitted and the ~C generates the desired sequence.

• Regarding multiple redirections, the ssh escaped command line only accepts a single command. You should press again the keyboard sequence to enter another command or redirection.

Answer 2

You can have multiple ssh connections. Port forwarding can be performed independently of your running connection. Further, it has to be performed on the client side for -L.

You can add -N -f to your command to background it from another terminal window and not send any ENTER. This backgrounding may not properly work in Windows, just minimise the terminal.

Yes, there is another answer covering ~C.