You can only SSH into one Ethernet interface because the SSH daemon is bound to a specific IP address or network interface rather than listening on all available addresses. This behavior is often intentional for security but can be confusing when you expect access from any connected network segment. The solution involves checking your SSH configuration file to ensure the ListenAddress directive is not restricting connections to a single interface, or verifying that firewall rules are not blocking traffic on the second interface's port.
Understanding SSH Binding Behavior
By default, many Linux distributions configure the OpenSSH server to listen on all available IPv4 and IPv6 addresses. However, system administrators often modify this setting to enhance security by binding the service to a management interface or a specific internal subnet. If you have two Ethernet interfaces, such as
eth0 for public traffic and
eth1 for private LAN traffic, the SSH service might only be active on
eth0.
This binding prevents attackers on the public internet from probing the private interface directly. It also reduces the attack surface by limiting the number of open ports visible to external networks. When troubleshooting connectivity issues, it is crucial to distinguish between a service that is down entirely and a service that is running but restricted to a specific network path.
To verify which interfaces your SSH daemon is currently listening on, you can use diagnostic tools like
ss or
netstat. Running
sudo ss -tlnp | grep sshd will display the local addresses and ports where the SSH process is accepting connections. If you see an entry like
192.168.1.10:22 instead of
*:22 or
0.0.0.0:22, the service is explicitly bound to that single IP address. This confirms that connections to other IPs, even if they belong to another Ethernet card on the same machine, will be rejected at the TCP level.
Checking Firewall Rules
Even if the SSH daemon is configured to listen on all interfaces, firewall software can block incoming connections on specific network segments. Linux systems typically use
iptables,
nftables, or higher-level wrappers like
ufw (Uncomplicated Firewall) or
firewalld. These tools operate at the network layer and can filter traffic based on source IP, destination IP, and interface name.
If your second Ethernet interface is on a different subnet, you must ensure that the firewall allows inbound TCP traffic on port 22 for that specific interface. For example, using
ufw, you might need to run a command like
sudo ufw allow in on eth1 to any port 22. With
firewalld, you would check if the zone assigned to the second interface has the
ssh service enabled. Misconfigured firewall rules are a common cause of intermittent SSH access, especially in environments with dynamic IP assignment or complex routing tables.
It is also important to check for reverse path filtering settings in the kernel. If
rp_filter is enabled, the kernel may drop packets that do not appear to come from a valid route back to the sender. This can sometimes manifest as dropped SSH handshakes on multi-homed systems. You can inspect these settings via
/proc/sys/net/ipv4/conf/all/rp_filter and adjust them if necessary for your network topology.
Modifying the SSH Configuration
The primary configuration file for the OpenSSH server is located at
/etc/ssh/sshd_config. To allow SSH connections on all Ethernet interfaces, you should look for the
ListenAddress directive. If this line is commented out or absent, the server defaults to listening on all interfaces. If it is present and set to a specific IP, you have two options: comment it out to restore default behavior, or add additional lines for each interface IP you wish to support.
For example, adding
ListenAddress 0.0.0.0 ensures IPv4 listeners on all interfaces, while
ListenAddress :: does the same for IPv6. After making changes, you must restart the SSH service for them to take effect. On systemd-based systems, use
sudo systemctl restart sshd. Always test the configuration before restarting to avoid locking yourself out. You can validate the syntax with
sudo sshd -t. If the test passes, proceed with the restart.
In some cases, you may want to restrict SSH access to specific users or key types on certain interfaces. This can be achieved using
Match blocks in the same configuration file. This advanced feature allows you to apply different authentication policies depending on the source IP or interface, providing granular control over remote access security.
Verifying Network Routing and Interfaces
Sometimes the issue is not with the SSH service itself but with the network stack. Ensure that both Ethernet interfaces are up and have valid IP addresses. Use
ip addr show to list all network interfaces and their associated IPs. If the second interface shows as
DOWN, bring it up with
sudo ip link set eth1 up. Additionally, verify that the routing table includes a route for the subnet associated with the second interface. Without a proper route, packets destined for that interface may be dropped or sent to the wrong gateway.
For more detailed insights into network connectivity, you might find our guide on
How to Log in to Your Router with SSH After Enabling Port Forwarding helpful, as it covers similar concepts regarding network interface accessibility and firewall interactions. Understanding how routers handle multiple interfaces can provide context for why your local machine behaves similarly.
Frequently Asked Questions
Why can I ping the second interface but not SSH?
Pinging uses ICMP protocol, which is often allowed by firewalls even when TCP port 22 is blocked. SSH requires a successful TCP handshake on port 22. Check your firewall rules specifically for TCP traffic on the SSH port for that interface.
Does SSH work over IPv6 on multiple interfaces?
Yes, but you must ensure the SSH daemon is configured to listen on IPv6 addresses. Add
ListenAddress :: to your
sshd_config file if you want to accept IPv6 connections on all interfaces. Verify that your router is advertising IPv6 prefixes correctly.
Can I use different SSH keys for different interfaces?
Not directly through the interface binding alone. You can use
Match Address directives in
sshd_config to require specific authorized keys for connections coming from certain IP ranges. This adds a layer of security tailored to the network segment.
What happens if I bind SSH to a non-existent IP?
The SSH daemon will fail to start or log an error indicating that the address is not available. Always verify that the IP address exists on an interface before adding it to the configuration. Use
ip addr to confirm current assignments.
How do I test SSH connectivity without logging in?
Use
nc -zv 22 to check if the port is open and accepting connections. Alternatively, use
telnet 22 to see the SSH banner string returned by the server. These tools help isolate whether the issue is network-related or authentication-related.