1

I have a VPS with multiple IP addresses allocated to it (we can use debian, centos or ubuntu). I can ssh tunnel through the server using any of the IP addresses. However, any ssh tunnel I set up always shows just one IP address to the final destination site.

me --ssh to IP1 --> |server|----> http:// whatismyip.com (displays IP1)

me --ssh to IP2--> |server|----> http:// whatismyip.com (displays IP1)

me --ssh to IP3--> |server|----> http:// whatismyip.com (displays IP1)

How do I configure the server so that when I ssh tunnel into IP1, its outbound IP is IP1. And when I ssh tunnel into IP2, its outbound IP is IP2?

What I want: me --ssh to IP1 --> |server|----> http:// whatismyip.com (displays IP1)

me --ssh to IP2--> |server|----> http:// whatismyip.com (displays IP2)

The IPs are in different subnets (actually different Class As entirely).

4
  • I don't understand the question. If you initiate the SSH tunnel from C1 to P1 those two will always be the end points. The server can't respond from another IP. Please clarify.
    – pehrs
    Mar 31, 2010 at 17:01
  • Clarified Above (I hope)
    – Peter Johansson
    Mar 31, 2010 at 17:51
  • Tell us more about the IP addresses you have assigned. Are they all in the same subnet?
    – Zoredache
    Mar 31, 2010 at 18:53
  • Added that the IPs are in different subnets.
    – Peter Johansson
    Mar 31, 2010 at 20:02

6 Answers 6

5

The IP address you use to make your connection to the SSH server really has nothing to do with what IP address that is used by SSH when it initiates outbound connections on your behalf.

The source address of packets being transmitted via a tunnel is going to depend a lot more on route table(s) and default gateway of the SSH server.

If all your addreses are in the same subnet I don't believe there is any way that you will be able to set the source address using only ssh.

As an alternative I believe you could setup multiple instances of OpenVPN each with their own tun and ip address range. Then setup different NAT rules for packets coming from each VPN instance.

2

thats a dirty solution and can cause problems.

> iptables -t nat -A POSTROUTING -j SNAT --to IP2
> 
> so 
> IP1 ---> IP2 
> IP2 ---> IP2 
> IP3 ---> IP2

If you need to change and dont have any other iptables rules, just restart iptables, than everything should be flushed.

I have the same trouble like you, and thats the best i could found out.

1

This isn't a tunneling problem. If you are on the server and SSH from it (that's how you make a tunnel, right?), you'll see that those tunnels are setup using the same IP address.

This is a TCP routing problem. if you run netstat -rn, you'll see your routing table. Most likely, you are routing all packets out the same interface -- your default route. You need very specific routes that have a higher priority than your default route to take precedence.

1

You can add different users for every ip, and match them on their userid:

useradd IP1
iptables -t nat -m owner --uid-owner IP1 -A POSTROUTING -j SNAT --to IP1

user IP1 will now always use IP1, even trough ssh.

0

Sorry, this is no answer -- I was hoping to be able to append a comment to the above instead but I'm new to this site.

I just wanted to add that I heard it may be possible to set which interface is used for outgoing traffic per shell user (UID). Not entirely sure how, I'm trying to figure it out myself because it's been a long time now I've wanted to use the 3 outgoing IPs on my VPS (without setting up dedicated proxy software).

-1

Better you edit file ~/.ssh/config file. If not exist you may create that file. Sample....

Host server1
     HostName server1.cyberciti.biz
     User nixcraft
     Port 4242
     IdentityFile /nfs/shared/users/nixcraft/keys/server1/id_rsa

Then you may easily type ssh server1 from your command shell.

1
  • This doesn't even remotely address the question. Jan 4, 2021 at 14:29

You must log in to answer this question.