Can you describe in clearer terms what you're trying to do and why? The "Why" will help greatly. What are the clients? What is the protocol?
There are many ways to do this based on the protocols and data streams.
Consider pf, iptables or ebtables injection, see "ssh blacklist" for examples.
Look at LVS, HAproxy and other load balancers for general redirection.
An old trick is a "wake-up" system. This works great for SSH or other encrypted protocols that make it more cpu intensive to determine source domain.(decode the header) This leaves only a single port running when no one is connected.
- SSH in to a single open port (no terminal support necessary)
- log into system as userX (preferably using keys), this runs a script that starts up another instance of the server on port XXXXX and replies to the client with the new port number
- "port XXXXX is open" message is transferred back to client, initial ssh session is closed
- client or client app then re-connects using the now open port XXXXX
- when client disconnects the alternate instance on port XXXXX is closed and/or port XXXXX is closed.
Specific ports can be assigned based on keys/users, reverse lookup, message passing, etc.
Some just leave the instances running and open/close using pf/iptables firewall injection. Others extend this using a firewall rule to trigger the service startup and have no initial SSH (or other service) running until a specified port is pinged with a specific type of packet. I prefer a "recently matched" custom firewall rule to block stray packets and stopping/starting the server instances for less dynamic interaction with the firewall.
This idea can work with any protocol and service that can be coded or scripted.
Reading materials for TCP/IP Networking: Anything written or recommended by W. Richard Stevens.
Don't discount using SSH tunnels as a in-development stopgap. These could achieve everything you need with no code. What is your app? Shouldn't it's communication be secure? How are you going to blacklist script kiddie hackers? That's more you'll have to write and debug. You should be compartmentalizing your code anyway, so develop everything else using SSH as the transport, port forwarding, encryption, usage logging, blacklisting, etc.. Then when everything else is done write your own network protocol mechanism to replace SSH. There is no need for terminal access for users on the gateway SSH server to use tunnels.