Sign up ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

I'm looking for a reliable way to start a secure tunnel at boot on a laptop.

This tunnel will not be needed by other parts of the boot process, but could be needed at any subsequent time by a user. It should "just work", the user should not have to monitor and fix it.

The secure tunnel will "pull in a port" from a insecure application bound to localhost (in this case, a redis database) on a remote server to the ubuntu laptop.


remote server:

remote port to forward: 6379, bound only to localhost from

remote user:

keyfile: has authorized a ssh keypair with no passphrase, one key is stored in authorized_keys on the server and the other in /root/moleKey.rsa on the laptop

This works inside a terminal window on the laptop:

$ sudo su
# ssh -i /root/moleKey.rsa -L 16379:localhost:6379 -N &
# exit
$ telnet localhost 16379
(works fine)

So then I tried putting

ssh -i /root/moleKey.rsa -L 16379:localhost:6379 -N &

into /etc/rc.local

But that doesn't work reliably, the ssh process was gone when the tunnel was needed and I can't find any error lines for it in syslog or messages

Is there a more reliable way to start the secure tunnel at boot-up, or perhaps a manager that will restart the secure tunnel as needed?

share|improve this question

2 Answers 2

For ubuntu 11.10+, the package "gstm" does OK at providing an easier way to set up the tunnel.


share|improve this answer
If anyone has a better answer I would still be interested. – Paul Apr 17 '12 at 8:29

I was having the same issues with /etc/rc.local not being persistent through reboots

Upstart is a good solution and this works for me:

# location: /etc/init/tunnel.conf 
description "persistent ssh tunnel through reboots"
author "morgan mcdaris <>"

start on (local-filesystems and net-device-up IFACE=eth0)
stop on runlevel [016]

respawn limit 5 60

  exec su LOCAL_USERNAME -c "ssh -N -R 4040:localhost:22 -i /home/LOCAL_USERNAME/.ssh/id_rsa REMOTE_USERNAME@REMOTE_MACHINE_IP"
end script

post-start script
   PID=`status tunnel | egrep -oi '([0-9]+)$' | head -n1`
   echo $PID > /var/run/
end script

post-stop script
    rm -f /var/run/
end script


after that you can start it up by rebooting or:

$ sudo start tunnel

the post-start scripts give a pid file if you want to do some monit stuff

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.