Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a machine with two public IP addresses on two interfaces. This machine is running sshd. Is there a way to specify, when creating a tunnel with a SOCKS interface (i.e. -D), which interface to use for outgoing connections?

share|improve this question
technically that's not an sshd question, since once the packet exits the tunnel into the remote machine's IP stack, it's at the mercy of the routing table on that machine, subject to modification by any ipf/iptables rules that may be in place. i'd tag this question with whatever firewall type your remote system uses, and I bet you can find an answer, even if it's as simple as adding specific routing table entries for specific destinations. – Tim Kennedy Aug 6 '12 at 4:22
up vote 1 down vote accepted

Strictly speaking, you can solve your problem by a combination of the -b option in ssh, as suggested by mgjk, and routing. Suppose you are trying to build a tunnel to the site (just a fictitious example), and you want the connection to go through eth1, then the command

 sudo route add -host dev eth1

will add a proper route, and all should be well.

However, this is also the perfect case of application for "policy routing". It entails configuring the routing table on the machine setting up the tunnel (i.e. the one on which the command ssh -D ... is issued) simply because it's the only one on which the two interfaces exist.

A concise yet sufficient explanation is given by David Schwartz on this very site. Only important detail is: say eth0 is, and eth1 is, then you may say

 ip rule add from table <NAME1>
 ip rule add from table <NAME2>

At this point, you can bind your ssh connection via -b to eth1's address, and you are done.

share|improve this answer

What happens when you use -b?

 -b bind_address
         Use bind_address on the local machine as the source address of
         the connection.  Only useful on systems with more than one
share|improve this answer
But I want to specify the source address of connections on the remote machine. I tried -b but it doesn't seem to do anything. – Cactus Apr 8 '12 at 4:28
You can do per flow routing, can't you? On remote machine make a rule in your firewall configuration to use specific gateway. (It works with OpenBSD's PF openbsd.org/faq/pf/pools.html#outgoing, so I guess there should be a way to do it with Linux iptables). – Jiri Xichtkniha Apr 10 '12 at 12:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.