Search code examples
sshreversetunnelsshdauthorized-keys

Restricting an SSH public key to open reverse tunnels (through ssh -R) only on a specific port

I have a few machines that will live behind NAT that I want to administer. My idea for this is to have them automatically set up reverse SSH tunnels back to my own server. However, since I'll have several such clients that will all be connected at the same time I want to limit every client to setting up a reverse tunnel only on a specific port. So that when I do ssh -p <tunnelport> <useronclient>@localhost I don't have several clients on the same port. I've been trying to do this through the authorized_keys file on the server but haven't found a way.

Any idea on how to do this? Or am I going about this in the wrong way? I Appreciate any help!

Solution

  • You can't do that for remote port forwarding (you can for Local port forwarding). You specify the port number as the part of the -R argument so

    • You have to choose unique port for each server behind NAT, if you want to allow concurrent connections and to distinguish between the servers.
    • If you have unique port for each server, what is the problem?

    If more clients would try to create port-forwarding to the same port, the later would fail.