Not sure how to title the question, but the situation is as follows:

I have 3 servers:


on TUNNEL I run command


which enables me to ssh from USER to TARGET by connecting to TUNNEL at port 22222

USER:~$ ssh TUNNEL -p 22222

The question is: From the TARGET point of view, will the connection appear as coming from USER or TUNNEL?

2 Answers 2


If you connect to the server via a forwarded port, it will be seen as originating locally.

TIP: You can directly connect to target using using ProxyJump. It can be used as $ ssh -J user@TUNNEL user@TARGET. In case you have an older version of openssh client, you can make use of ProxyCommand.

  • So is there a way for TARGET to actually know the original IP of the client? I am asking because: what if I whitelist IP (at TARGET) of the TUNNEL and disable everything else - Will I be able to ssh into TARGET from USER ? (Too afraid to try). Is this how one sets up bastions/jump servers?
    – redacted
    Jun 6, 2017 at 18:43
  • 1
    It'll definitely work if you whitelist the tunnel and block all other external IP. That is a common practise in jump box setups.
    – vagarwal
    Jun 6, 2017 at 23:51

How hard is to set that up and try? For example using the $SSH_CONNECTION environment variable:

USER:~$ ssh TUNNEL -p 22222 'echo $SSH_CONNECTION'

But the first connection creates port forwarding, which is transparent for the application that is using it. So the second TCP connection starts on USER machine, reaches TUNNEL machine and from there is transparently forwarded to the TARGET machine. So once the TARGET asks from where the connection comes, he will get the real public IP address of USER.

  • Thanks, did not know about the SSH_CONNECTION variable! However when I ran that, i got 43452 22 So I don't get the real USER's public ip from that one. Is there a way how to "dig deeper"?
    – redacted
    Jun 5, 2017 at 10:09
  • So then it is not so transparent as I hoped in the answer. But I believe you will be able to figure out now.
    – Jakuje
    Jun 5, 2017 at 10:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.