Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Im trying to set up ssh/git access through a ssh gate but googleing has come up empty. Basically I want any connection to my ssh gate from the user git to be forwarded to my ssh server so that pushes and pulls can me made remotely. However if any other user connects I want them to be logged in as usual.

internet--(git)-->gate--(git)--> git-server


Any help or advice would be much appreciated.

One way to do this on the client side is to add the following to your .ssh/config:

    ProxyCommand      ssh nc %h %p
    User              git

But I was hoping that there would be a way to do this server side.

share|improve this question

1 Answer 1

I assume you're talking about Linux and OpenSSH. Please advise if this is not the case.

I understand that the git-server isn't directly reachable from the internet. I don't think you can do what you're proposing automatically just using SSH.

Let's assume gate is on (public IP) and git-server is at (RFC1918)

Depending on what exacly you're trying to achieve and what the constraints are, you could:

1) have the user connecting to the git-server forward a port first:

ssh -N -L2222: user@

and then they could log in as:

ssh -p2222 git@localhost

2) on the gate, you could forward connections made to to so your user would log in as: ssh -p2222 git@

This would require a few commands executed on the gate:

# enable forwarding
echo -n 1 > /proc/sys/net/ipv4/ip_forward
# DNAT packets destined for to
iptables -A PREROUTING -d -p tcp --dport 2222 -j DNAT --to-destination
# allow responses from to get through
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
# allow forwarding connections to
iptables -A FORWARD -p tcp --dport 22 -d -j ACCEPT

There's nothing specific to do on the git-server.

share|improve this answer
Thanks for the input, I have landed on using the method I edited in at the top since it seems to be impossible to do this server side. Your method is quite similar and it actually reminded me of this method so thank you very much :) The reason Id prefer it server side is so laptops that are used both from local and external wouldnt run into problems. – Johan Oct 23 '12 at 15:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.