I need to set up an ssh port forwarder on a server (jump host) in a manner that the ssh client does not know the target destination.

client machine --> jumphostserver --> targetserver:port

I can set up an ssh tunnel locally on client machine which has credentials to jumphostserver. Then the client machine needs to know the details targetserver:port to be able to connect. The client machine must not know the targetserver.

I want to set up the port forwarder on the jumphostserver so that it forwards all traffic to `jumphostserver:port to targetserver:port.

So client tunnels to jumphostserver: ssh user@jumphostserver -f -N -L <port>:jumphostserver:<port>

and jumphostserver:port forwards all traffic on port to targetserver:port when any application/program on the client machine connects to localhost:port

How do I configure sshd for this on the jumphostserver?

  • 1
    You could use iptables for that. Search for iptables port forward and you will be good to go.
    – ThoriumBR
    Feb 3, 2022 at 17:31
  • thank you @THoriumBR I looked up iptables. I would need an IP address for the targetserver but I only have a dns name xxxx.yyyyy...aws.com
    – Vasuvius
    Feb 3, 2022 at 19:58
  • If the IP address is fixed, you can resolve it first and put on iptables. Or you can use linux.die.net/man/1/redir
    – ThoriumBR
    Feb 4, 2022 at 11:30

1 Answer 1


You could use a TCP reverse proxy on the jumphost for this, e.g., Nginx TCP and UDP Load Balancing with:

stream {
    server {
        proxy_pass targethost.example.com:12345;

Just ensure the user used for login on the jumphost does not have read permissions for Nginx's configuration file which has the target address that should be kept in secret from the client machine. Neither should it be able to run netstat on the jumphost, or any other method that could reveal the connections the jumphost is opening.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .