Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a VPS with multiple IP addresses allocated to it (we can use debian, centos or ubuntu). I can ssh tunnel through the server using any of the IP addresses. However, any ssh tunnel I set up always shows just one IP address to the final destination site.

me --ssh to IP1 --> |server|----> http:// (displays IP1)

me --ssh to IP2--> |server|----> http:// (displays IP1)

me --ssh to IP3--> |server|----> http:// (displays IP1)

How do I configure the server so that when I ssh tunnel into IP1, its outbound IP is IP1. And when I ssh tunnel into IP2, its outbound IP is IP2?

What I want: me --ssh to IP1 --> |server|----> http:// (displays IP1)

me --ssh to IP2--> |server|----> http:// (displays IP2)

The IPs are in different subnets (actually different Class As entirely).

share|improve this question
I don't understand the question. If you initiate the SSH tunnel from C1 to P1 those two will always be the end points. The server can't respond from another IP. Please clarify. – pehrs Mar 31 '10 at 17:01
Clarified Above (I hope) – Peter Johansson Mar 31 '10 at 17:51
Tell us more about the IP addresses you have assigned. Are they all in the same subnet? – Zoredache Mar 31 '10 at 18:53
Added that the IPs are in different subnets. – Peter Johansson Mar 31 '10 at 20:02

The IP address you use to make your connection to the SSH server really has nothing to do with what IP address that is used by SSH when it initiates outbound connections on your behalf.

The source address of packets being transmitted via a tunnel is going to depend a lot more on route table(s) and default gateway of the SSH server.

If all your addreses are in the same subnet I don't believe there is any way that you will be able to set the source address using only ssh.

As an alternative I believe you could setup multiple instances of OpenVPN each with their own tun and ip address range. Then setup different NAT rules for packets coming from each VPN instance.

share|improve this answer

This isn't a tunneling problem. If you are on the server and SSH from it (that's how you make a tunnel, right?), you'll see that those tunnels are setup using the same IP address.

This is a TCP routing problem. if you run netstat -rn, you'll see your routing table. Most likely, you are routing all packets out the same interface -- your default route. You need very specific routes that have a higher priority than your default route to take precedence.

share|improve this answer

thats a dirty solution and can cause problems.

> iptables -t nat -A POSTROUTING -j SNAT --to IP2
> so 
> IP1 ---> IP2 
> IP2 ---> IP2 
> IP3 ---> IP2

If you need to change and dont have any other iptables rules, just restart iptables, than everything should be flushed.

I have the same trouble like you, and thats the best i could found out.

share|improve this answer

Sorry, this is no answer -- I was hoping to be able to append a comment to the above instead but I'm new to this site.

I just wanted to add that I heard it may be possible to set which interface is used for outgoing traffic per shell user (UID). Not entirely sure how, I'm trying to figure it out myself because it's been a long time now I've wanted to use the 3 outgoing IPs on my VPS (without setting up dedicated proxy software).

share|improve this answer

You can add different users for every ip, and match them on their userid:

useradd IP1
iptables -t nat -m owner --uid-owner IP1 -A POSTROUTING -j SNAT --to IP1

user IP1 will now always use IP1, even trough ssh.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.