I'm running a test server behind NAT. I've forwarded remote port 2222 from another public IP server (example.com) to port 22 of the server behind NAT (localhost) as follows.

autossh -f -N -i /root/.ssh/id_rsa -R 2222:localhost:22 [email protected]

Now the local ssh server behind NAT getting only ::1 as IP address of all clients irrespective of client's actual IP address.

Output from w in localhost is like this.

 22:27:37 up  8:03,  2 users,  load average: 0.03, 0.03, 0.09
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
user tty7     :0               14:24    8:03m  1.27s  0.33s /usr/bin/lxsession -s LXDE-pi -e LXDE
user pts/0    ::1              22:27    1.00s  0.34s  0.03s w

/var/log/auth.log in localhost has entry like this

Feb 28 22:27:32 localhost sshd[5201]: Accepted password for user from ::1 port 55168 ssh2

Now I want to run fail2ban or csf firewall to block spam IP addresses. So, I want client's actual IP address. How can I do this? Is any iptables NAT rewriting rule helpful?

  • You cannot use failtoban to block IPs and you only see the IP address of the other side of the SSH tunnel... Mar 2, 2018 at 19:40
  • @RuiFRibeiro Yes, that's true. I'm asking is there a way to get the client's actual IP instead the IP address of other side of the tunnel's localhost ip ::1?
    – Abhik Bose
    Mar 2, 2018 at 19:43
  • 1
    I prefer going in via a VPN and not expose ssh ports to the Internet. Mar 2, 2018 at 19:51
  • 1
    Maybe running a tun device and using iptables would be the solution? Mar 3, 2018 at 8:01

1 Answer 1


The SSH protocol messages for opening a TCP forwarding session include the IP address and port of the client which connected to the forwarded port. The OpenSSH ssh utility just logs the information and doesn't do anything else with it:

$ ssh -v -R 2048:localhost:22 localhost
debug1: client_request_forwarded_tcpip: listen localhost port 2048, originator ::1 port 49341

To do something useful with the information, you'd have to do one of the following:

  • Run ssh in debug mode and capture and parse the relevant debug output.
  • Modify the ssh utility to log the information or otherwise do what you need it to do with the information.
  • Use a different ssh client, or write your own. SSH libraries exist for most modern programming languages.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .