Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a server that we'll call hub-server.tld with three IP addresses,, and I have three different machines that are behind a firewall, but I want to use SSH to port forward one machine to each IP address. For example: machine-one should listen for SSH on port 22 on, while machine-two should do the same on, and so on for different services on ports that may be the same across all of the machines.

The SSH man page has -R [bind_address:]port:host:hostport listed I have gateway ports enabled, but when using -R with a specific IP address, server still listens on the port across all interfaces:


# ssh -NR root@hub-server.tld

hub-server.tld (Listens for SSH on port 2222):

# netstat -tan | grep LISTEN
tcp        0      0*                   LISTEN
tcp        0      0 :::22                       :::*                        LISTEN
tcp        0      0 :::80                       :::*                        LISTEN

Is there a way to make SSH forward only connections on a specific IP address to machine-one so I can listen to port 22 on the other IP addresses at the same time, or will I have to do something with iptables? Here are all the lines in my ssh config that are not comments / defaults:

Port 2222
Protocol 2
SyslogFacility AUTHPRIV
PasswordAuthentication yes
ChallengeResponseAuthentication no
GSSAPIAuthentication no
GSSAPICleanupCredentials no
UsePAM yes
AllowTcpForwarding yes
GatewayPorts yes
X11Forwarding yes
ClientAliveInterval 30
ClientAliveCountMax 1000000
UseDNS no
Subsystem       sftp    /usr/libexec/openssh/sftp-server
share|improve this question
up vote 20 down vote accepted

From sshd_config(5):


  Specifies whether remote hosts are allowed to connect to ports forwarded 
  for the client.  By default, sshd(8) binds remote port forwardings to the
  loopback address. This prevents other remote hosts from connecting to 
  forwarded ports.  GatewayPorts can be used to specify that sshd should 
  allow remote port forwardings to bind to non-loopback addresses, thus 
  allowing other hosts to connect.  The argument may be “no” to force remote 
  port forwardings to be available to the local host only, “yes” to force 
  remote port forwardings to bind to the wildcard address, or 
  “clientspecified” to allow the client to select the address to which the 
  forwarding is bound.  The default is “no”.

You want to set this to clientspecified instead of yes.

share|improve this answer
Awesome, thank you! I really wish the man page for ssh(1) stated that clientspecified was needed instead of just saying "enabled": "Specifying a remote bind_address will only succeed if the server's GatewayPorts option is enabled (see sshd_config(5))". From that, I thought it just needed to be set to yes. – Eric Pruitt Apr 13 '12 at 23:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.