6

So unfortunately I live in a place that will not let me have a static IP, so I have been setting up access to my home computer via reverse SSH tunnels that run on an micro amazon ec2 instance. I have gotten SSH to work fine, but I cannot figure out port forwards.

Here is a small infographic I made to help illustrate (i felt the question was clearer with a diagram of what I was trying to do.

Here are the commands listed in the graphic:

I the following on my home computer: 

ssh -R 1337:localhost:22 -i .ssh/tokyoMinekey.pem ec2-user@ec2serveraddress

and I run this on the ec2 server: 

ssh -L6600:localhost:6600 -Nf localhost -p 1337

diagram of my pain...in paint AHHHHHH YEAHHHHHH!

FYI, I have added port 6600 into my security group for amazon ec2, so its open on the ec2 side

Gareth
  • 19,080
Hortinstein
  • 408

2 Answers2

3

I'm not sure why you are using two separate ssh commands here? If you want to forward port 6600 on the EC2 instead to port 6600 on the machine at home then all you should need to do is:

ssh -R :6600:localhost:6600 -i .ssh/tokyoMinekey.pem ec2-user@ec2serveraddress

You will also need to make sure that the GatewayPorts option is enabled in the sshd_config file on the EC2 instance.

Obviously you will need to leave that ssh connection open for the port forward to continue working but other than that there shouldn't be any problems.

TomH
  • 3,262
2

Could you please provide the output of:

netstat -tulpen

on ec2serveraddress. I expect to see that both tunnels are starting at 127.0.0.1:PORT? 127.0.0.1 is the IP of the local machine itself, not accessible from outside. That means you can access this tunnel from the server itself but not from any other machine...

If this is the case, please add the following to your /etc/ssh/sshd_config:

GatewayPorts yes

This option will create the ports at 0.0.0.0, so you can connect from everywhere. If there are no other reasons for creating two connected tunnels you can of course shrink it to only one:

ssh -R 6600:localhost:22 -i .ssh/tokyoMinekey.pem ec2-user@ec2serveraddress

This will create a tunnel ec2serveraddress:6600 to your home:22.

binfalse
  • 1,832