I currently ssh into a device where I have a bunch of -L and -R port forwards between my client and the device. But this isn't unique to me; everyone else who should ssh into this device needs these ports mapped.

What is the best way to translate the -L/-R ssh syntax into a permanent configuration on the device side? Is it even possible for -R forwards, even if its on the localhost?

  • 1
    This doesn't appear to have anything to do with iptables/nftables so I have removed the tags.
    – larsks
    Jul 26, 2023 at 2:53
  • Fair. I had a strong suspicion that the closest solution might require one of the two, based off other answers, but it's not required.
    – JWCS
    Jul 26, 2023 at 4:56

1 Answer 1


You can't place any configuration onto the device side, because by the time you have access to the remote device, the connection has already been established. You can only place configuration options in your local ~/.ssh/config` file.

It would be a terrible security problem if the remote end could configure forwarding; imagine if a malicious administrator arranged for access to your local machine whenever you logged into their server!

On your local system, you can configure the equivalent of -L and -R in your ssh configuration using the LocalForward and RemoteForward configuration options.

If you would normally run something like:

ssh -L 2000:localhost:2000 -L 3000:localhost:3000 -R 2200:localhost:22 myhost.example.com

Then you could place the following in ~/.ssh/config:

Host myhost.example.com
  LocalForward 2000 localhost:2000
  LocalForward 3000 localhost:3000
  RemoteForward 2200 localhost:22

Then whenver you run ssh myhost.example.com, ssh would set up the requested local and remote port forwarding.

  • 1
    Don't forget that while that first ssh session with the port forwarding configuration is active, a second session (and third, etc) will report it can't listen on the local ports - the first session already has them.
    – Sotto Voce
    Jul 26, 2023 at 4:18
  • Ah! I had forgotten about the security implications whilst looking for feasibility; even if LocalForwards are more easily configurable on the remote, to auto attach ports can be malicious. I do happen to have ssh + forwards as a bash alias, so I can change the remote from one (nearly identical) setup to the next, as I (or others) have to go in. But in summary, based on your answer, if for no other reason than safety, then yes, all config should be on the local, no automatic port connections by the remote. (I can almost hear the hounds of sec/compliance at my door).
    – JWCS
    Jul 26, 2023 at 5:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .