Score:0

SSH Bind Address - Cannot Assign Requested Address

in flag

I've got 2 NIC's, and just want to SSH from one specific interface. As you can see, the -b option in ssh doesn't seem to be able to use my address. Not sure why?

$ ip a show enp8s0 | grep "default\|inet "
2: enp8s0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master INT-VRF1 state UP group default qlen 1000
    inet 172.31.16.22/24 brd 172.31.16.255 scope global dynamic noprefixroute enp8s0

$ ping -I enp8s0 172.31.16.10
PING 172.31.16.10 (172.31.16.10) from 172.31.16.22 enp8s0: 56(84) bytes of data.
64 bytes from 172.31.16.10: icmp_seq=1 ttl=255 time=0.627 ms
64 bytes from 172.31.16.10: icmp_seq=2 ttl=255 time=2.49 ms

$ ssh -b 172.31.16.22 172.31.16.10
bind 172.31.16.22: Cannot assign requested address
ssh: connect to host 172.31.16.10 port 22: failure

It's like SSH is unaware of the VRF. I thought this could be a namespace issue so tried also using the kernel settings below to no avail.

$ sudo sysctl -a | grep l3mdev
net.ipv4.raw_l3mdev_accept = 1
net.ipv4.tcp_l3mdev_accept = 1
net.ipv4.udp_l3mdev_accept = 1

Added below as per request of comment:

$ ip -4 addr list | grep 172.31.16.22
inet 172.31.16.22/24 brd 172.31.16.255 scope global dynamic noprefixroute enp8s0

UPDATE

I did manage to get this working via the below:

$ sudo ip vrf exec INT-VRF1 ssh 172.31.16.10

However, I can only get it working with sudo. Otherwise I get:

$ ip vrf exec INT-VRF1 ssh 172.31.16.10
Failed to load BPF prog: 'Operation not permitted'

Not sure why really. But I just need to be able to use client apps like SSH over this interface. How/What is the way to do it?

The only thing I can seem to find online is about binding the application's SO_BINDTODEVICE to a certain interface in order to force a socket to be created on a specific NIC. But I'm really not sure how to go about setting this up with for an SSH client connection.

ru flag
Show the output of `ip -4 addr list`. If the IP doesnt show bound to these systems in the address lists you cant bind to the IP with services on system.
john smith avatar
in flag
Updated post to show its there
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.