SSH Remote Forwarding Configuration and GatewayPorts

the gatewayports parameter in the ssh daemon configuration (/etc/ssh/sshd config) determines how the remote server binds sockets during remote port forwarding depending on this setting, specific firewall or agent rule exceptions may be required scenario 1 gatewayports set to yes when gatewayports is enabled, sshd forces the remote forwarding port to bind to all available interfaces · binding behavior the service binds specifically to 0 0 0 0 for ipv4 and for ipv6 · rule requirements if your default policy is to deny all requests, your exceptions must explicitly include 0 0 0 0 (ipv4) and (ipv6) in the interface section · command override any specific interface ip provided in the ssh command (e g , ssh r interface ip\ port ) will be ignored; the daemon will still bind to all interfaces scenario 2 gatewayports set to clientspecified this setting allows the client to choose which interface the forwarded port should bind to · binding behavior the sshd server respects the specific interface ip provided in the remote forwarding command · rule requirements the interface section of your tunneling rule exceptions should match the specific ip address of the interface on the agent host being utilized · example if an agent host has multiple interfaces (e g , 10 x x 1 and 10 x x 2), and a user executes ssh r 10 x x 1 8443\ target ip 443 user\@host the tunnel will bind only to 10 x x 1 to permit this traffic, the interface section of the security rule must be configured to allow 10 x x 1