I'm looking for a reliable way to start a secure tunnel at boot on a laptop.

This tunnel will not be needed by other parts of the boot process, but could be needed at any subsequent time by a user. It should "just work", the user should not have to monitor and fix it.

The secure tunnel will "pull in a port" from a insecure application bound to localhost (in this case, a redis database) on a remote server to the ubuntu laptop.


remote server: example.net

remote port to forward: 6379, bound only to localhost from example.net

remote user: mole@example.net

keyfile: mole@example.net has authorized a ssh keypair with no passphrase, one key is stored in authorized_keys on the server and the other in /root/moleKey.rsa on the laptop

This works inside a terminal window on the laptop:

$ sudo su
# ssh -i /root/moleKey.rsa -L 16379:localhost:6379 mole@example.net -N &
# exit
$ telnet localhost 16379
(works fine)

So then I tried putting

ssh -i /root/moleKey.rsa -L 16379:localhost:6379 mole@example.net -N &

into /etc/rc.local

But that doesn't work reliably, the ssh process was gone when the tunnel was needed and I can't find any error lines for it in syslog or messages

Is there a more reliable way to start the secure tunnel at boot-up, or perhaps a manager that will restart the secure tunnel as needed?

2 Answers 2


I was having the same issues with /etc/rc.local not being persistent through reboots

Upstart is a good solution and this works for me:

# location: /etc/init/tunnel.conf 
description "persistent ssh tunnel through reboots"
author "morgan mcdaris <morganmcdaris@gmail.com>"

start on (local-filesystems and net-device-up IFACE=eth0)
stop on runlevel [016]

respawn limit 5 60

  exec su LOCAL_USERNAME -c "ssh -N -R 4040:localhost:22 -i /home/LOCAL_USERNAME/.ssh/id_rsa REMOTE_USERNAME@REMOTE_MACHINE_IP"
end script

post-start script
   PID=`status tunnel | egrep -oi '([0-9]+)$' | head -n1`
   echo $PID > /var/run/tunnel.pid
end script

post-stop script
    rm -f /var/run/tunnel.pid
end script


after that you can start it up by rebooting or:

$ sudo start tunnel

the post-start scripts give a pid file if you want to do some monit stuff

  • Upstart is deprecated. Last version was released in 2014. Jun 19, 2019 at 20:17

For ubuntu 11.10+, the package "gstm" does OK at providing an easier way to set up the tunnel.


http://web.archive.org/web/20150318153045/http://linuxers.org/article/manage-your-ssh-tunnel-redirects-graphically-using-gnome-ssh-tunnel-manager (original link now dead)

  • If anyone has a better answer I would still be interested.
    – Paul
    Apr 17, 2012 at 8:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.