The command for forwarding port 80 from your local machine (
localhost) to the remote host on port 8000 is:
ssh -R 8000:localhost:80 oli@remote-machine
This requires an additional tweak on the SSH server, add the lines to
Match User oli
Next, reload the configuration by server executing
sudo reload ssh.
GatewayPorts yes causes SSH to bind port 8000 on the wildcard address, so it becomes available to the public address of
If you need to have the option for not binding everything on the wildcard address, change
GatewayPorts yes to
GatewayPorts clientspecified. Because
ssh binds to the loopback address by default, you need to specify an empty
bind_address for binding the wildcard address:
ssh -R :8000:localhost:80 oli@remote-machine
8000 is mandatory if
GatewayPorts is set to
userspecified and you want to allow public access to
Relevant manual excerpts:
Specifies that the given port on the remote (server) host is to be forwarded to the given host and port on the local side. This works by allocating a socket to listen to port on the remote side, and whenever a connection is made to this port, the connection is forwarded over the secure channel, and a connection is made to host port hostport from the local machine. By default, the listening socket on the server will be bound to the loopback interface only. This may be overridden by specifying a bind_address. An empty bind_address, or the address ‘*’, indicates that the remote socket should listen on all interfaces. Specifying a remote bind_address will only succeed if the server's GatewayPorts option is enabled (see sshd_config(5)).
Specifies whether remote hosts are allowed to connect to ports forwarded for the client. GatewayPorts can be used to specify that sshd should allow remote port forwardings to bind to non-loopback addresses, thus allowing other hosts to connect. The argument may be 'no' to force remote port forwardings to be available to the local host only, 'yes' to force remote port forwardings to bind to the wildcard address, or 'clientspecified' to allow the client to select the address to which the forwarding is bound. The default is 'no'.