What does "bind_address" mean in SSH port forwarding?

Question

In SSH local forwarding:

 -L [bind_address:]port:host:hostport
         Specifies that the given port on the local (client) host is to be forwarded to the given host and port on the remote side.  This works by
         allocating a socket to listen to port on the local side, optionally bound to the specified bind_address.  Whenever a connection is made to
         this port, the connection is forwarded over the secure channel, and a connection is made to host port hostport from the remote machine.  Port
         forwardings can also be specified in the configuration file.  IPv6 addresses can be specified by enclosing the address in square brackets.
         Only the superuser can forward privileged ports.  By default, the local port is bound in accordance with the GatewayPorts setting.  However,
         an explicit bind_address may be used to bind the connection to a specific address.  The bind_address of “localhost” indicates that the listen‐
         ing port be bound for local use only, while an empty address or ‘*’ indicates that the port should be available from all interfaces.

In "an empty address or * indicates that the port should be available from all interfaces", what do "all interfaces" mean? Does it mean all the network interfaces on the local host when the local host can have multiple network interfaces, and the port port can be used with all the network interfaces on the local host?

In "The bind_address of localhost indicates that the listening port be bound for local use only", does "for local use only" mean a particular network interface on the local host?

Can bind_address refer to a network interface on a host other than the local host?

Answer 1

In general, an address binding is an association between a service (e.g., SSH) and an IP address.

A host may have multiple IP addresses (e.g., 127.0.0.1, 192.168.1.2). Address binding allows you to run a service on some or all of these addresses.

Suppose your host is configured with two network interfaces, one connected to a trusted network (e.g., 192.168.1.0/24), the other connected to an untrusted network (e.g., 192.168.2.0/24). Say you want your host to accept SSH connections from the trusted network only. In this case, you would bind the SSH service to the host's address on the trusted network only (e.g., 192.168.1.2).

Using localhost as bind_address would allow only SSH clients running on the local machine to connect to the SSH service.

Answer 2

All interfaces means... all interfaces, though perhaps with the exceptions for special interfaces such as pflog0 (the packet filter log interface). Local use means the loopback interface, typically lo0 or such, which should have the ::1 address assigned to it. The main distinction here is whether or not remote systems can access the port; using localhost, only processes on the local system would be able to connect.

The bind address can indeed be a not-local address. However, this should cause something like a bind: Can't assign requested address error, so will not serve much if any purpose.