Multiple Reverse SSH Tunnels using Single Port

Question

I am able to accept reverse SSH connections from multiple remote systems on a single server using a port for each connection:

Remote A: ssh -fN -R5000:localhost:22 user@server-ip -p22
Remote B: ssh -fN -R5001:localhost:22 user@server-ip -p22
Remote C: ssh -fN -R5002:localhost:22 user@server-ip -p22

I can access these systems from my local client as needed:

Access Remote A: ssh root@server-ip -p5000
Access Remote B: ssh root@server-ip -p5001

This requires forwarding one port per remote system on the server. When 100+ remotes connect, do I have any options other than opening 100+ ports in the server firewall and statically assigning each remote to a port as above? My goal is to enable multiple remotes to create tunnels on demand, where I can query who is connected.

I found that sslh is a multiplexer that can differentiate between traffic on a single port based on protocol but this only applies to different protocols eg. ssl/ssh. Is there a solution that allows multiple tunnels on a single port?

Example:

Remote A: ssh -fN -R5000:localhost:22 user@server-ip -p22 -identifier abc123
Remote B: ssh -fN -R5000:localhost:22 user@server-ip -p22 -identifier def456
access Remote A: ssh root@server-ip -p5000 -identifier abc123
access Remote B: ssh root@server-ip -p5000 -identifier def456

Answer 1

I have the same issue you do and, by the time, have only arrived at one possible answer. My scenario is a bit different than yours as I only need one active ssh tunnel, but all clients must be ready to connect if needed.

I guess one could create a client/server simple protocol to handle all the clients and create a list of some sort. The user then could chose one of the clients to create the reverse tunnel. Doing that would require another open port rather than the ssh server, but using a threaded server one could listen() to various clients under the same port for this secondary protocol.

I'm still working on a solution (I'll probably implement what I just wrote), but mind you in your case you should decide the max number of clients connected at a single time and configure that amount of ports. As mine is just a small linux "support" for embedded devices, I can only work on one device at a time anyway, so I only need 1 device.

A cleverer idea would be to inform the client over the aux protocol at which server port to attach the reverse tunnel.