I have 3 PCs:

  • A is behind a firewall and cannot be reached from outside the local network
  • B is outside the A network, has a public DNS but cannot see A
  • C is a laptop without public DNS that often changes IP

I would like to create a reverse ssh tunnel from A to B in order to allow C to reach A passing through B. I read some guides and followed the procedure, but i'm doing something wrong.

I try to recap what've done.

Doing this on A

ssh -Nfg -R 2210:localhost:22 userB@B

allows me to reach A from B doing on B

ssh -p 2210 userA@localhost

To reach A from C I can do on C

ssh userB@B
ssh -p 2210 userA@localhost

Until now everything looks great. Now I would like to connect from C to A directly. This is not laziness, but is (i think) required to use FileZilla from C to A.

I go back to step 1 and do on A:

ssh -Nfg -R :2210:localhost:22 userB@B

(note the ":" before 2210)

I also edited the /etc/ssh/sshd_config file on B adding at the end.

GatewayPorts yes

But doing on C

ssh -p 2210 userA@B

returns a timeout error.

Where I do wrong?

Thank you very much

PS: also another way to open the tunnel and allow FileZilla to connect from C to A would be ok.

  • Is ssh -Nfg -R :2210:logalhost:22 userB@B what you are actually doing or is this a typo meaning ssh -Nfg -R :2210:localhost:22 userB@B
    – Elder Geek
    Apr 11 '15 at 18:53
  • What does a netstat -tulpen on B shows? Is port 2210 accessible from external or just from localhost? Please paste the related line here.
    – lumen
    Apr 13 '15 at 14:03
  • @Elder Geek: it was a typo inside the post. Sorry and congratulation for the attention :)
    – Luca
    Apr 28 '15 at 8:28

Solved thanks to Lars Noodén on UbuntuForum here

I report the solution for future readers:

You have created a reverse tunnel from port 22 on A to port 2210 on B. Add a regular tunnel from any port on C (e.g. 2212) to port 2210 on B.

ssh -L 2212:localhost:2210 userB@hostB

Then on C you can point FileZIlla, or any other SFTP client, at port 2212 on the localhost and it will be connecting to A.

Using this solution I can easily do ssh -p 2212 userA@localhost on C to connect directly to A from C. Furthermore I can use the port 2212 on localhost for all the services I need to connect from C to A that doesn't allow tunnels (e.g. Filezilla).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.