Re: [gentoo-user] Configure sshd to listen on specific interfaces?

[Victor Ivanov]

On 27/08/2020 14:40, Grant Edwards wrote:
> I do _not_ want it to listen on 0.0.0.0.
>
> I want it to listen on 127.0.0.1 and on whatever IP addresses are
> assigned to two specified interfaces.

As far as I'm aware, I don't think OpenSSH allows for listening on a
specific interface.

You can, however, work around this in a rather unusual way via
ip/nftables and DNAT.

You will need to enable IP[v6] forwarding via sysctl (or sysctl.conf):

    net.ipv4.ip_forward=1
    net.ipv4.conf.<IFACE>.route_localnet=1

The latter option is critical as, by default, the kernel will not allow
you to route to 127.0.0.0/8 as a security precaution.


iptables
========

(1) iptables -t nat -A PREROUTING -i <IFACE> -p tcp --dport 22 -j DNAT
--to-destination 127.0.0.1:22
[2] ip6tables -t nat -A PREROUTING -i <IFACE> -p tcp --dport 22 -j DNAT
--to-destination [::1]:22


nftables (json-like)
====================

table inet nat {
  chain prerouting {
    type nat hook prerouting priority dstnat; policy accept;
    iif "<IFACE>" tcp dport 22 dnat ip to 127.0.0.1:22
    iif "<IFACE>" tcp dport 22 dnat ip6 to [::1]:22
  }
}


nftables (cmdline)
==================

[1] nft add table inet nat
[2] nft add chain inet nat prerouting { type nat hook prerouting
priority dsnat\; }
(3) nft add rule inet nat prerouting iif <IFACE> tcp dport 22 dnat ip to
127.0.0.1:22
[4] nft add rule inet nat prerouting iif <IFACE> tcp dport 22 dnat ip6
to [::1]:22

As always, 1-2 are not required if you already have a relevant table/chain.

Adjust as needed for multiple IFACEs.

- V