Shorewall users - Sep 2011 - Allowing reverse ssh tunnels?

I''m trying to setup a reverse ssh tunnel via ssh''ing into my
VPS
running shorewall.

I believe I am creating the tunnel properly
ssh me@myhost -R 7777:localhost:80

On the VPS it seems to be created the listener:
netstat -an | grep 7777
tcp        0      0 127.0.0.1:7777          0.0.0.0:*               LISTEN
tcp6       0      0 ::1:7777                :::*                    LISTEN

But I cannot connect through it.
I tried adding a straight ACCEPT rule in shorewall, but that does not  
give any connection from outside. (nmap doesn''t see the port, etc).
I tried adding a DNAT rule pointing to 127.0.0.1, but that shows as  
filtered when I nmap, and again will not connect through.

I assume I''m missing something basic, but I''ve never tried
reverse ssh
tunnels before.
I did notice that I CAN connect from the VPS box through the reverse  
tunnel to my machine, so the tunnel itself obviously works, which  
means I''m apparently missing the right way to setup shorewall to let  
other connect through it to the tunnel.

Any help would be appreciated.

Thanks.

Mark II
-- 
Mark D. Montgomery II
http://www.techiem2.net



------------------------------------------------------------------------------
All the data continuously generated in your IT infrastructure contains a
definitive record of customers, application performance, security
threats, fraudulent activity and more. Splunk takes this data and makes
sense of it. Business sense. IT sense. Common sense.
http://p.sf.net/sfu/splunk-d2dcopy1

Quoting "Mark D. Montgomery II" <techiem2@techiem2.net>:
> I''m trying to setup a reverse ssh tunnel via ssh''ing into
my VPS
> running shorewall.
>
> I believe I am creating the tunnel properly
> ssh me@myhost -R 7777:localhost:80

Figured it out with friend''s help.
It was binding to the local adapter on the vps instead of to all, thus  
keeping it from talking to anyone other than the vps itself.
You need to do ssh me@myhost -R *:7777:localhost:80 and have  
GatewayPorts enabled in the sshd config.


Mark II

-- 
Mark D. Montgomery II
http://www.techiem2.net



------------------------------------------------------------------------------
All the data continuously generated in your IT infrastructure contains a
definitive record of customers, application performance, security
threats, fraudulent activity and more. Splunk takes this data and makes
sense of it. Business sense. IT sense. Common sense.
http://p.sf.net/sfu/splunk-d2dcopy1