up vote 0 down vote favorite
share [g+] share [fb]

looking at OpenSSH client's manpage - there's an option, such as -D, that enables one to use the SSHD in a form of a dynamic SOCKS proxy/port forwarder.

my question is as follows: is it somehow possible to manipulate/select the exact IP address that outgoing connections are going to be bound to, in either the SSHD config or by some params within the ssh client?

the actual problem that i am facing: the system has 2 IP addresses, A on eth0 and B on eth1. The sshd runs on B, but when i'm actually trying to tunnel some traffic in a way described above - all outgoing connections are bound to the socket on A. What i want to do is - be able to select by binding either on A or B. Is that possible (without exchanging places of eth0 and eth1)?

link|improve this question
50% accept rate
feedback

1 Answer

up vote 2 down vote

The outgoing interface is selected according to the system's routing rules. o in the end, the target of the tunnel decides which interface is chosen. You can only select which interface is chosen by adapting our routing table.

Typically, when you have two or more interfaces in a box, these are configured into different non-overlapping subnets. In this case, it doesn't make sense to force another interface, as the connected subnet wouldn't be able to deal with the packages. If you have multiple interfaces configured in the same subnet, you have to adapt your routing tables anyway to have a meaningful configuration.

link|improve this answer
currently, both of the interfaces involved lie in the same subnet and their IP addresses differ only by the last octet. 'eth0' is the only NIC that is actually connected with ethernet, 'eth1' gets routed through it without any secondary configuration (the only issue, is that it is not really possible to count the traffic on it). – XXL Mar 6 '11 at 21:52
>Kernel IP routing table >Destination Gateway Genmask Flags Metric Ref Use Iface >x.y.z.0 * 255.255.255.128 U 0 0 0 eth0 >x.y.z.0 * 255.255.255.128 U 0 0 0 eth1 >default hosted.by.abc 0.0.0.0 UG 0 0 0 eth1 >default hosted.by.abc 0.0.0.0 UG 0 0 0 eth0 – XXL Mar 6 '11 at 21:52
the thing is, why does the -R switch, i.e., have the capability of binding to the specified address on the sshd's host, but the -D option is without this addition? i do not really see any major difference/complexity of implementation, if it actually allowed to do this. Also, what if i just had an alias on eth0, for the IP addr that is currently present on eth1, would that assist in a solution, in any way? Basically, what kind of a solution could there be, at all, apart from modifying the routing table? – XXL Mar 6 '11 at 22:07
the bind_address can be specified with -R and -D. But this address select where the socket for incoming connections is bound to. – Holger Just Mar 6 '11 at 22:13
yes, i am aware of that - but the difference being, that with -D it is only client-side, with -R it is both client-side and server-side. What i was referring to, is the actual possibility of binding the socket on the server-side. The implementation of binding the socket for outgoing connections is even more relaxed, than listening on that same socket for incoming connections. It seems like a worthy addition for cases such as this and keeps me wondering why is it yet to be implemented up to this date.. – XXL Mar 7 '11 at 8:14
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.