Accessing localhost web server via reverse SSH tunnel and URL
-R 8080:localhost:80
is usually not enough. See man 1 ssh
[emphasis mine]:
-R [bind_address:]port:host:hostport
[…]Specifies that connections to the given TCP port or Unix socket on the remote (server) host are to be forwarded to the local side.
[…]
By default, TCP listening sockets on the server will be bound to the loopback interface only. This may be overridden by specifying a
bind_address
. An emptybind_address
, or the address*
, indicates that the remote socket should listen on all interfaces. Specifying a remotebind_address
will only succeed if the server'sGatewayPorts
option is enabled (seesshd_config(5)
).
Your tries with 127.0.0.1:8080
on the server indicate the listening socket is bound to the loopback interface. Most likely it is not bound to any other interface.
You need to explicitly specify bind_address
or to use *
or to use an empty string as bind_address
. The option with an empty bind_address
looks like this (note the leading :
):
-R :8080:localhost:80
Additionally the state of GatewayPorts
in the sshd_config
on the server is important. From man 5 sshd_config
:
GatewayPorts
Specifies whether remote hosts are allowed to connect to ports forwarded for the client. By default,
sshd(8)
binds remote port forwardings to the loopback address. This prevents other remote hosts from connecting to forwarded ports.GatewayPorts
can be used to specify thatsshd
should allow remote port forwardings to bind to non-loopback addresses, thus allowing other hosts to connect. The argument may beno
to force remote port forwardings to be available to the local host only,yes
to force remote port forwardings to bind to the wildcard address, orclientspecified
to allow the client to select the address to which the forwarding is bound. The default isno
.
To achieve what you want the option must not be no
. Note no
is the default value, so unspecified GatewayPorts
still means no
. The value of yes
will make -R 8080:localhost:80
work like -R :8080:localhost:80
.
I advise GatewayPorts clientspecified
in the server config and ssh -R :8080:localhost:80 …
on the client.
After changing the config file you need to restart the SSH server or otherwise tell it to reload the configuration. sshd
from OpenSSH rereads its configuration upon receiving a hangup signal, SIGHUP.
Possible additional problems:
- The firewall on the server may block connections to the
8080
port coming in from the Internet. - The local HTTP server may reject requests that use
example.com
(compare Why does the original site work, but port forwarding to the same site fails?).