Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I hope I'm phrasing this question correctly. I have a SSH server that I use for testing that has 2 internet connections running on it. The LAN connection is always on, but the USB connection is on intermittently. Is it possible to restrict the tunnel so that it only ever uses the IP address of the USB connection to browse the internet?

This is what I'm currently using:

ssh -v -D 3456 root@mysshserver.net;

This is great, but it doesn't tell me if the server's secondary USB connection changes. As I know the IP (for arguments sake of the USB connection, I was hoping I could restrict the tunnel to only using the USB and breaking if the USB went down. I've been playing around with the following:

ssh -v -D *:3456 -R *:3456: root@mysshserver.net;

But I think I'm using -R wrong. Is there a better way to achieve this?

share|improve this question
SSH won't be able to manage the network juggling on it's own. Maybe a better solution is to tackle the USB network connection drop by running a script to reinitialize it. – Tim Jul 9 '13 at 20:28
Ah, I see. Looking for something more seamless than just a restarter, but thanks anyway. – jnthnclrk Jul 9 '13 at 20:35
up vote 1 down vote accepted

I am not aware of a ssh option that can accomplish this, it seems like a routing problem. You would like to route all traffic of the SSH daemon over the USB connection as a policy. Policy routing allows you to route packets over different paths, in your case over the USB connection. You will need ip to set the policy and iptables to mark packets for that policy.

An (untested) example that routes all traffic over the interface with gateway

iptables -t mangle -A OUTPUT -m owner --uid-owner yourusername -j MARK --set-mark 2
ip rule add fwmark 2 table 3
ip route add default via table 3
ip route flush cache

All packets from user yourusername will be marked with ID 2. Then, a rule states that this mark 2 must follow routing table 3 which takes packets to gateway Finally, the route cache is cleared such that the new route is picked up (if the route was calculated before).

This assumes that the SSH user yourusername is only used for the SOCKS tunnel and that you connect to it through the USB connection.

share|improve this answer
I will try this now... – jnthnclrk Jul 9 '13 at 22:07
Ah, I should have mentioned that the SSH server is a Mac. Not sure if they have iptables, but perhaps this would work: serverfault.com/a/105736/73641 ? – jnthnclrk Jul 9 '13 at 22:12
@jnthnclrk Hmm, I do not think that there is a one-to-one mapping for these firewall/mark things. However, the keyword that you are looking for is policy routing. Perhaps you can even restrict it to a single program. – Lekensteyn Jul 9 '13 at 22:17
OK, thanks. I'll take this request over to the Server Fault or Super User site. – jnthnclrk Jul 9 '13 at 22:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.