On 27/08/2020 14:40, Grant Edwards wrote: > I do _not_ want it to listen on 0.0.0.0. > > I want it to listen on 127.0.0.1 and on whatever IP addresses are > assigned to two specified interfaces.
As far as I'm aware, I don't think OpenSSH allows for listening on a
specific interface.
You can, however, work around this in a rather unusual way via
ip/nftables and DNAT.
You will need to enable IP[v6] forwarding via sysctl (or sysctl.conf):
net.ipv4.ip_forward=1
net.ipv4.conf.<IFACE>.route_localnet=1
The latter option is critical as, by default, the kernel will not allow
you to route to 127.0.0.0/8 as a security precaution.
iptables
========
(1) iptables -t nat -A PREROUTING -i <IFACE> -p tcp --dport 22 -j DNAT
--to-destination 127.0.0.1:22
[2] ip6tables -t nat -A PREROUTING -i <IFACE> -p tcp --dport 22 -j DNAT
--to-destination [::1]:22
nftables (json-like)
====================
table inet nat {
chain prerouting {
type nat hook prerouting priority dstnat; policy accept;
iif "<IFACE>" tcp dport 22 dnat ip to 127.0.0.1:22
iif "<IFACE>" tcp dport 22 dnat ip6 to [::1]:22
}
}
nftables (cmdline)
==================
[1] nft add table inet nat
[2] nft add chain inet nat prerouting { type nat hook prerouting
priority dsnat\; }
(3) nft add rule inet nat prerouting iif <IFACE> tcp dport 22 dnat ip to
127.0.0.1:22
[4] nft add rule inet nat prerouting iif <IFACE> tcp dport 22 dnat ip6
to [::1]:22
As always, 1-2 are not required if you already have a relevant table/chain.
Adjust as needed for multiple IFACEs.
- V
signature.asc
Description: OpenPGP digital signature
