Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a server that we'll call hub-server.tld with three IP addresses 100.200.130.121, 100.200.130.122, and 100.200.130.123. I have three different machines that are behind a firewall, but I want to use SSH to port forward one machine to each IP address. For example: machine-one should listen for SSH on port 22 on 100.200.130.121, while machine-two should do the same on 100.200.130.122, and so on for different services on ports that may be the same across all of the machines.

The SSH man page has -R [bind_address:]port:host:hostport listed I have gateway ports enabled, but when using -R with a specific IP address, server still listens on the port across all interfaces:

machine-one:

# ssh -NR 100.200.130.121:22:localhost:22 root@hub-server.tld

hub-server.tld (Listens for SSH on port 2222):

# netstat -tan | grep LISTEN
tcp        0      0 100.200.130.121:2222        0.0.0.0:*                   LISTEN
tcp        0      0 :::22                       :::*                        LISTEN
tcp        0      0 :::80                       :::*                        LISTEN

Is there a way to make SSH forward only connections on a specific IP address to machine-one so I can listen to port 22 on the other IP addresses at the same time, or will I have to do something with iptables? Here are all the lines in my ssh config that are not comments / defaults:

Port 2222
Protocol 2
SyslogFacility AUTHPRIV
PasswordAuthentication yes
ChallengeResponseAuthentication no
GSSAPIAuthentication no
GSSAPICleanupCredentials no
UsePAM yes
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL
AllowTcpForwarding yes
GatewayPorts yes
X11Forwarding yes
ClientAliveInterval 30
ClientAliveCountMax 1000000
UseDNS no
Subsystem       sftp    /usr/libexec/openssh/sftp-server
share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

From sshd_config(5):

GatewayPorts
        Specifies whether remote hosts are allowed to connect to ports forwarded for the client.  By default, sshd(8) binds remote
        port forwardings to the loopback address.  This prevents other remote hosts from connecting to forwarded ports.  GatewayPorts
        can be used to specify that sshd should allow remote port forwardings to bind to non-loopback addresses, thus allowing other
        hosts to connect.  The argument may be “no” to force remote port forwardings to be available to the local host only, “yes” to
        force remote port forwardings to bind to the wildcard address, or “clientspecified” to allow the client to select the address
        to which the forwarding is bound.  The default is “no”.

You want to set this to clientspecified instead of yes.

share|improve this answer
    
Awesome, thank you! I really wish the man page for ssh(1) stated that clientspecified was needed instead of just saying "enabled": "Specifying a remote bind_address will only succeed if the server's GatewayPorts option is enabled (see sshd_config(5))". From that, I thought it just needed to be set to yes. –  Eric Pruitt Apr 13 '12 at 23:42
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.