Ssh – reverse ssh tunnel from server to laptop

debianport-forwardingshorewallsshssh-tunnel

Question I would like to know how to tunnel requests made on a server (debian) to port 80 on my laptop using ssh tunneling.

Problem I can open up a tunnel with the following command that does not behave quite as I would like:

ssh -R 4445:localhost:80 sam@example.com

After running this and getting a shell at example.com, the following command executes as expected returning the web page being hosted on my laptop:

wget localhost:4445

However, when trying to run this same command using example.com:4445 rather than localhost:4445, I get a connection refused.

Extra info: I also tried writing a forwarding rule using shorewall:

DNAT            net             $FW:127.0.0.1:4445        tcp     4446

and then tried

wget example.com:4446

When wget fails in any of the above cases, I get this:

--2011-02-16 13:48:26--  http://example.com:4446/
Resolving example.com... 70.90.XXX.XX
Connecting to example.com|70.90.XXX.XX|:4446... failed: Connection refused.

Any ideas on where to go from here? Also, if there is different / better way to achieve this effect I am completely open to the idea.

EDIT Thanks for the suggestions!
Tried the following:

ssh -R example.com:4445:localhost:80 sam@example.com

and

ssh -R :4445:localhost:80 sam@example.com

Then when running the same wget as above came back with the same error. I should maybe mention that this server has two interfaces (eth0 public eth1 private).

EDIT

I am a moron 🙁 Had to set 

GatewayPorts yes

in sshd_config. Thanks for the help everyone!

Best Answer

ssh is configured for security reasons to make the new tunnels to listen on localhost. You have to use:

ssh -R :4445:localhost:80 sam@example.com

From the man page of openssh:

 -R [bind_address:]port:host:hostport

Specifies that the given port on the remote (server) host is to be forwarded to the given host and port on the local side. This works by allocating a socket to listen to port on the remote side, and whenever a connection is made to this port, the connection is forwarded over the secure channel, and a connection is made to host port hostport from the local machine.

Port forwardings can also be specified in the configuration file. Privileged ports can be forwarded only when logging in as root on the remote machine. IPv6 addresses can be specified by enclosing the address in square braces or using an alternative syntax: [bind_address/]host/port/hostport.

By default, the listening socket on the server will be bound to the loopback interface only. This may be overridden by specifying a bind_address. An empty bind_address, or the address ‘*’, indicates that the remote socket should listen on all interfaces. Specifying a remote bind_address will only succeed if the server’s GatewayPorts option is enabled (see sshd_config(5)).

Related Topic