MacOS – Local Forwarding does not work

command linemacosssh

I have tried to forward local ports over SSH to a remote host:

$ cat .ssh/config
host km4ayu.com
LocalForward 29070 127.0.0.1:29070

I've tried a bunch of things, but how do I make this forwarding accept connections from other hosts on my local network?
i.e., listen on 192.168.1.116:29070 and forward traffic to km4ayu.com:29070?

My .ssh/config Host entry:

Host km4ayu.com
AddressFamily inet
User kv4lq
Port 17785
GatewayPorts yes
LocalForward 3306 127.0.0.1:3306
LocalForward 17786 127.0.0.1:17786
LocalForward 17787 127.0.0.1:17787
LocalForward *:29070 www.km4ayu.com:29070
LocalForward *:29071 www.km4ayu.com:29071

Here's the output of ssh -vvv km4ayu.com, using that .ssh/config file:

Pauls-Mac-mini:~ esmith$ ssh -vvv km4ayu.com
OpenSSH_6.9p1, LibreSSL 2.1.8
debug1: Reading configuration data /Users/esmith/.ssh/config
debug1: /Users/esmith/.ssh/config line 23: Applying options for km4ayu.com
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 20: Applying options for *
debug1: /etc/ssh/ssh_config line 53: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to km4ayu.com [104.168.167.30] port 17785.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /Users/esmith/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/esmith/.ssh/id_rsa-cert type -1
debug1: identity file /Users/esmith/.ssh/id_dsa type 2
debug1: key_load_public: No such file or directory
debug1: identity file /Users/esmith/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/esmith/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/esmith/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/esmith/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/esmith/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.9
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1
debug1: match: OpenSSH_6.6.1p1 pat OpenSSH_6.6.1* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to km4ayu.com:17785 as 'kv4lq'
debug3: put_host_port: [km4ayu.com]:17785
debug3: hostkeys_foreach: reading file "/Users/esmith/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /Users/esmith/.ssh/known_hosts:46
debug3: load_hostkeys: loaded 1 keys from [km4ayu.com]:17785
debug3: order_hostkeyalgs: prefer hostkeyalgs: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-dss-cert-v00@openssh.com,ssh-ed25519,ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: kex_parse_kexinit: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug1: kex: server->client chacha20-poly1305@openssh.com <implicit> none
debug1: kex: client->server chacha20-poly1305@openssh.com <implicit> none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:/214EQvH59cIt2nCaT+XhRruKws4j7Jwo3anBGMGO6g
debug3: put_host_port: [104.168.167.30]:17785
debug3: put_host_port: [km4ayu.com]:17785
debug3: hostkeys_foreach: reading file "/Users/esmith/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /Users/esmith/.ssh/known_hosts:46
debug3: load_hostkeys: loaded 1 keys from [km4ayu.com]:17785
debug3: hostkeys_foreach: reading file "/Users/esmith/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /Users/esmith/.ssh/known_hosts:46
debug3: load_hostkeys: loaded 1 keys from [104.168.167.30]:17785
debug1: Host '[km4ayu.com]:17785' is known and matches the ECDSA host key.
debug1: Found key in /Users/esmith/.ssh/known_hosts:46
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /Users/esmith/.ssh/id_rsa (0x0),
debug2: key: /Users/esmith/.ssh/id_dsa (0x7fd0a150c890),
debug2: key: /Users/esmith/.ssh/id_ecdsa (0x0),
debug2: key: /Users/esmith/.ssh/id_ed25519 (0x0),
debug1: Authentications that can continue: publickey,password
debug3: start over, passed a different list publickey,password
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /Users/esmith/.ssh/id_rsa
debug3: no such identity: /Users/esmith/.ssh/id_rsa: No such file or directory
debug1: Offering DSA public key: /Users/esmith/.ssh/id_dsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-dss blen 433
debug2: input_userauth_pk_ok: fp SHA256:Ei0O+3c1WbhkKzluFhdvzXhV5v/Is9if+bG+fYm+Qx8
debug3: sign_and_send_pubkey: DSA SHA256:Ei0O+3c1WbhkKzluFhdvzXhV5v/Is9if+bG+fYm+Qx8
debug1: Authentication succeeded (publickey).
Authenticated to km4ayu.com ([104.168.167.30]:17785).
debug1: Local connections to *:3306 forwarded to remote address 127.0.0.1:3306
debug3: channel_setup_fwd_listener_tcpip: type 2 wildcard 1 addr NULL
debug1: Local forwarding listening on 0.0.0.0 port 3306.
debug2: fd 6 setting O_NONBLOCK
debug3: fd 6 is O_NONBLOCK
debug1: channel 0: new [port listener]
debug1: Local connections to *:17786 forwarded to remote address 127.0.0.1:17786
debug3: channel_setup_fwd_listener_tcpip: type 2 wildcard 1 addr NULL
debug1: Local forwarding listening on 0.0.0.0 port 17786.
debug2: fd 7 setting O_NONBLOCK
debug3: fd 7 is O_NONBLOCK
debug1: channel 1: new [port listener]
debug1: Local connections to *:17787 forwarded to remote address 127.0.0.1:17787
debug3: channel_setup_fwd_listener_tcpip: type 2 wildcard 1 addr NULL
debug1: Local forwarding listening on 0.0.0.0 port 17787.
debug2: fd 8 setting O_NONBLOCK
debug3: fd 8 is O_NONBLOCK
debug1: channel 2: new [port listener]
debug1: Local connections to *:29070 forwarded to remote address www.km4ayu.com:29070
debug3: channel_setup_fwd_listener_tcpip: type 2 wildcard 1 addr NULL
debug1: Local forwarding listening on 0.0.0.0 port 29070.
debug2: fd 9 setting O_NONBLOCK
debug3: fd 9 is O_NONBLOCK
debug1: channel 3: new [port listener]
debug1: Local connections to *:29071 forwarded to remote address www.km4ayu.com:29071
debug3: channel_setup_fwd_listener_tcpip: type 2 wildcard 1 addr NULL
debug1: Local forwarding listening on 0.0.0.0 port 29071.
debug2: fd 10 setting O_NONBLOCK
debug3: fd 10 is O_NONBLOCK
debug1: channel 4: new [port listener]
debug1: channel 5: new [client-session]
debug3: ssh_session2_open: channel_new: 5
debug2: channel 5: send open
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug2: callback start
debug2: fd 3 setting TCP_NODELAY
debug3: ssh_packet_set_tos: set IP_TOS 0x10
debug2: client_session2_setup: id 5
debug2: channel 5: request pty-req confirm 1
debug1: Sending environment.
debug3: Ignored env TERM_PROGRAM
debug3: Ignored env SHELL
debug3: Ignored env TERM
debug3: Ignored env TMPDIR
debug3: Ignored env Apple_PubSub_Socket_Render
debug3: Ignored env TERM_PROGRAM_VERSION
debug3: Ignored env TERM_SESSION_ID
debug3: Ignored env USER
debug3: Ignored env SSH_AUTH_SOCK
debug3: Ignored env __CF_USER_TEXT_ENCODING
debug3: Ignored env PATH
debug3: Ignored env PWD
debug1: Sending env LANG = en_US.UTF-8
debug2: channel 5: request env confirm 0
debug3: Ignored env XPC_FLAGS
debug3: Ignored env XPC_SERVICE_NAME
debug3: Ignored env SHLVL
debug3: Ignored env HOME
debug3: Ignored env LOGNAME
debug3: Ignored env _
debug2: channel 5: request shell confirm 1
debug2: callback done
debug2: channel 5: open confirm rwindow 0 rmax 32768
debug2: channel_input_status_confirm: type 99 id 5
debug2: PTY allocation request accepted on channel 5
debug2: channel 5: rcvd adjust 2097152
debug2: channel_input_status_confirm: type 99 id 5
debug2: shell request accepted on channel 5
kv4lq@server1:~$ 

Best Answer

This behavior is controlled by option GatewayPorts (off by default). From manual page for ssh_config:

GatewayPorts

Specifies whether remote hosts are allowed to connect to local forwarded ports. By default, ssh(1) binds local port forwardings to the loopback address. This prevents other remote hosts from connecting to forwarded ports. GatewayPorts can be used to specify that ssh should bind local port forwardings to the wildcard address, thus allowing remote hosts to connect to forwarded ports.

The argument must be “yes” or “no”. The default is “no”.

You need to put also

GatewayPorts yes

to your ssh_config, and specify the local address explicitly:

LocalForward 192.168.1.116:29070 127.0.0.1:29070