I want to route network traffic that comes from one end of an ssh tunnel (constructed by ssh dynamic port-forwarding) into one end of a VPN tunnel.

Given four Linux devices A, B, C and D, for example, I want to make a network traffic route

A --ssh_tunnel--> B ------> C


A --ssh_tunnel--> B --GRE_tunnel--> D ------> C

All the IP addresses of these devices are static except C which is dynamic. To make the above topology, I properly configured device D and confirmed that the GRE tunnel is successfully established.

However I could not find how to configure device B in order to route traffic that comes from A through the ssh tunnel to the GRE tunnel which is established between B and D. Since the IP address of C is dynamic, destination-based routing which can be configured on B (using route) is not possible. Actually I tried to configure device B with ip and iptables command lines to apply source based routing, but I could not reach a solution.

  • just to give a helpful hint: did you try or searched for masquerading in iptables? With this you can reach portforwarding, you can define interfaces instead of static IP's with this, as far as I know
    – quenia
    Jun 23, 2015 at 12:03

1 Answer 1


Assuming you just want to forward a SSH connection all the way down to C, you could e.g. make the SSH endpoint on B a dedicated user account, and then use the iptables owner module to match --uid-owner username in order to get that traffic to go out through the interface towards D.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .