post past :: james murty

When developing a web site or application, you may sometimes need to expose the development version running inside your network to the public Internet. This can be necessary to test the communication between your application and an external service, such as PayPal.

If you have secure shell access to a publicly accessible server, you can achieve this using the port forwarding feature of ssh to redirect traffic from the Internet to your own machine. Ideally, you would use the secure shell’s -R option to forward a remote port. For example, to forward traffic arriving on port 8888 of your public server to port 8000 on your local machine you would do the following: ssh -R *:8888:127.0.0.1:8000 However, for remote forwarding to work the GatewayPorts option must be enabled on your public server. This option is rarely enabled by default, and if you lack the admin privileges or desire to change this setting you will be unable to use remote port forwarding directly.

In this situation there is a work-around that achieves the same result without relying on the GatewayPorts setting being enabled: local port forwarding from the public server back to your own machine. Because your machine probably isn’t accessible from the public server (at least, it shouldn’t be…) you will need to pre-prepare an ssh tunnel that will allow you to connect back to your computer.

All this talk of tunnels upon tunnels is confusing, so let’s cut straight to the commands. First, log in to the public server with ssh while opening a port to allow a reverse ssh connection back to your machine. Here, I will forward the server’s port 2222 to port 22 on my local development machine: ssh -R2222:127.0.0.1:22 james@publicserver.com Now, connect back to your own computer using the tunnelled port 2222, while at the same time opening a public port to direct Internet traffic from the server to your machine. The following command will forward traffic sent to the server’s 8888 port back to my computer’s 8000 port. ssh -g -L8888:127.0.0.1:8000 -p 2222 jmurty@127.0.0.1 In this command, the -g option allows Internet traffic to be forwarded from the server rather than just local traffic, and the name jmurty is the user name credential for my development machine. Although I am seemingly connecting to the server at the loopback address 127.0.0.1, because I am using port 2222 I will actually be tunnelled back to the machine I started from.

In my experience, this work-around will give you the desired results even when the GatewayPorts setting is disabled on the server. It is not an ideal solution because the tunnelled traffic is encrypted twice so it is quite slow, but this trick may be useful as a stop-gap measure until your server administrator enables this setting on the server.