I have a server that we'll call hub-server.tld with three IP addresses,, and I have three different machines that are behind a firewall, but I want to use SSH to port forward one machine to each IP address. For example: machine-one should listen for SSH on port 22 on, while machine-two should do the same on, and so on for different services on ports that may be the same across all of the machines.

The SSH man page has -R [bind_address:]port:host:hostport listed I have gateway ports enabled, but when using -R with a specific IP address, server still listens on the port across all interfaces:


# ssh -NR root@hub-server.tld

hub-server.tld (Listens for SSH on port 2222):

# netstat -tan | grep LISTEN
tcp        0      0*                   LISTEN
tcp        0      0 :::22                       :::*                        LISTEN
tcp        0      0 :::80                       :::*                        LISTEN

Is there a way to make SSH forward only connections on a specific IP address to machine-one so I can listen to port 22 on the other IP addresses at the same time, or will I have to do something with iptables? Here are all the lines in my ssh config that are not comments / defaults:

Port 2222
Protocol 2
SyslogFacility AUTHPRIV
PasswordAuthentication yes
ChallengeResponseAuthentication no
GSSAPIAuthentication no
GSSAPICleanupCredentials no
UsePAM yes
AllowTcpForwarding yes
GatewayPorts yes
X11Forwarding yes
ClientAliveInterval 30
ClientAliveCountMax 1000000
UseDNS no
Subsystem       sftp    /usr/libexec/openssh/sftp-server

1 Answer 1


From sshd_config(5):


  Specifies whether remote hosts are allowed to connect to ports forwarded 
  for the client.  By default, sshd(8) binds remote port forwardings to the
  loopback address. This prevents other remote hosts from connecting to 
  forwarded ports.  GatewayPorts can be used to specify that sshd should 
  allow remote port forwardings to bind to non-loopback addresses, thus 
  allowing other hosts to connect.  The argument may be “no” to force remote 
  port forwardings to be available to the local host only, “yes” to force 
  remote port forwardings to bind to the wildcard address, or 
  “clientspecified” to allow the client to select the address to which the 
  forwarding is bound.  The default is “no”.

You want to set this to clientspecified instead of yes.

  • Awesome, thank you! I really wish the man page for ssh(1) stated that clientspecified was needed instead of just saying "enabled": "Specifying a remote bind_address will only succeed if the server's GatewayPorts option is enabled (see sshd_config(5))". From that, I thought it just needed to be set to yes. Apr 13, 2012 at 23:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.