I have the following configuration:

a DNS record of X.a.b.c pointing to an ip address I
a DNS record of Y.a.b.c pointing to the same ip I.


RT is a router (which i have no control over) that has I as left-hand IP and as internal IP.
FW is a firewall that has as the left-hand IP and as a right-hand IP.
MN has an IP of and Beh has an IP of

FW has rules to allow traffic on certain ports, and depending on those ports it forwards to a sepecific IP. For instance, port 22 is forwarded to MN (

I have 2 servers, each running on port 22 in each server Beh and MN and i want that, depending on what URL you access, you get connected to an specific server:

If i ssh me@X.a.b.c I get connected to MN. If i ssh me@Y.a.b.c I get connected to Beh.

Can i do this with IPtables?

  • i want that, depending on what IP you access, you get connected to an specific server: From where? If you are talking about from outside you firewall you said you only have 1 IP outside your firewall. So I am confused here. – Zoredache Sep 12 '14 at 21:49
  • edite: "i want that, depending on what URL you access, you get connected to an specific server:" – rica01 Sep 12 '14 at 22:18
  • A simpler solution would be to configure iptables to forward connections to I port 22 to MN port 22 and I port 2222 to Beh port 22. – Mark Wagner Sep 12 '14 at 22:31

As Zoredache mentioned, this isn't possible. The SSH protocol handshake begins with the server sending information to the client, so there isn't even a custom solution that could be coded to do some kind of trick proxying.

That said, what the others have stated about using multiple ports works great. Most GUI-based SSH clients have a good way to save sessions and setting the port is trivial and a non-issue. However, I'm going to take a quick jump out on the limb here and assume that the majority of the clients you are expecting to connect to this server are text-based and you do not want to type -oPort= everytime you use SSH.

Here is perhaps something that will make life a bit easier for everyone involved. The standard SSH-driven command line tools available on *nix systems all use the same configuration method.

In your workstations' ~/.ssh directory, create the file config. As with nearly all permissions when dealing with SSH, this will need to have permission: 600. Within this file, set up the following lines (assuming you forwarded ports 2222 and 2223)

Host X.a.b.c
   Port 2222

Host Y.a.b.c
   Port 2223

While this isn't exactly what you were hoping to achieve, it should help make the client-side of things more workable given you will only have to set it up once. Your SSH client will transparently "do the right thing" based on hostname for this configured workstation. Additionally, tools that rely on SSH will also do the right thing (git, scp, etc).


Sorry, but this isn't possible. Unlike http, the DNS name of the destination is resolved on the client and is not passed as part of the protocol in any way that your firewall could see.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.