Can a ssh reverse tunnel bind to something else than localhost?

Question

Machine A has a service (say - web server) bound to localhost:80. Machine B wants to access this service but has no direct connection to machine A.

I want to create a reverse ssh tunnel from Machine B to Machine A.

This works:

machine A> ssh -R 888:localhost:80 root@machineB

machine B> curl localhost:888
→ success

This does not work that much (192.168.10.1 I the IP of Machine B):

machine A> ssh -R 192.168.10.1:888:localhost:80 root@machineB

machine B> curl localhost:888
→ success

machine B> curl 192.168.10.1:888 -v
*   Trying 192.168.10.2:888...
* connect to 192.168.10.2 port 888 from 192.168.10.2 port 39764 failed: Connection refused
* Failed to connect to 192.168.10.2 port 888 after 0 ms: Couldn't connect to server
* Closing connection
curl: (7) Failed to connect to 192.168.10.2 port 888 after 0 ms: Couldn't connect to server

What happens is that localhost:888 is always successful, but trying the same on the NIC IP does not work.

I checked the bindings on Machine B the port is listening to localhost only:

machine B> ss -nltap | grep 888
LISTEN     0      0                                    127.0.0.1:888                     0.0.0.0:*     users:(("sshd",pid=3438633,fd=7))
LISTEN     0      0                                        [::1]:888                           *:*     users:(("sshd",pid=3438633,fd=5))

Is this a limitation of the technique, or am I missing something?

Answer 1

It can, but the ability needs to be activated in the server's configuration. With OpenSSH on the server, you need to enable

GatewayPorts clientspecified

in its sshd_config before the server will allow such requests.