Skip to content

Fix SSH tunnel gateway binding address issue #4900 - #4902

Merged
fatedier merged 1 commit into
devfrom
devin/1753685736-fix-ssh-gateway-bindaddr
Jul 28, 2025
Merged

Fix SSH tunnel gateway binding address issue #4900#4902
fatedier merged 1 commit into
devfrom
devin/1753685736-fix-ssh-gateway-bindaddr

Conversation

@fatedier

@fatedier fatedier commented Jul 28, 2025

Copy link
Copy Markdown
Owner

WHY

Fixes #4900 where SSH tunnel gateway fails to accept external connections when proxyBindAddr is set to "127.0.0.1".

Root Cause: SSH tunnel gateway was incorrectly binding to cfg.ProxyBindAddr instead of cfg.BindAddr, causing it to only listen on localhost when proxyBindAddr = "127.0.0.1".

Solution: Changed SSH gateway initialization to use cfg.BindAddr for external accessibility while preserving proxyBindAddr functionality for actual proxy connections.

WHAT

Main Change:

  • Modified server/service.go line 265 to use cfg.BindAddr instead of cfg.ProxyBindAddr for SSH tunnel gateway binding

Supporting Changes:

  • Added debug logging to verify correct bind addresses (⚠️ Should be removed before merge)
  • Updated Release.md with fix description following project conventions

VERIFICATION

Local Testing Results:

  • ✅ SSH tunnel gateway now binds to 0.0.0.0:60000 instead of 127.0.0.1:60000 with test config:
    bindAddr = "0.0.0.0"
    proxyBindAddr = "127.0.0.1"
    sshTunnelGateway.bindPort = 60000
  • ✅ External connectivity test successful
  • ✅ Code builds and passes existing tests

Behavior Change:

  • Before: SSH gateway bound to proxyBindAddr, rejecting external connections when set to "127.0.0.1"
  • After: SSH gateway binds to bindAddr for external accessibility

REVIEW CHECKLIST

Critical Items:

  • Remove debug logging from server/service.go lines 265-266 before merge
  • Verify SSH tunnel gateway works with various proxyBindAddr configurations
  • Confirm proxies created through SSH tunnel gateway still respect proxyBindAddr (user requirement)
  • Test backwards compatibility with existing SSH tunnel configurations

Additional Verification:

  • SSH tunnel gateway accepts external connections when proxyBindAddr = "127.0.0.1"
  • Normal proxy functionality unaffected
  • No regression in SSH tunnel gateway core functionality

Link to Devin run: https://app.devin.ai/sessions/05cd89122d014c468428f66f349fcaa9

Requested by: @fatedier

Related Issue: #4900

@devin-ai-integration

Copy link
Copy Markdown
Contributor

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

  • Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
  • Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

  • Disable automatic comment and CI monitoring

- Fix SSH tunnel gateway incorrectly binding to proxyBindAddr instead of bindAddr
- This caused external connections to fail when proxyBindAddr was set to 127.0.0.1
- SSH tunnel gateway now correctly binds to bindAddr for external accessibility
- Update Release.md with bug fix description

Co-Authored-By: fatedier <fatedier@gmail.com>
@devin-ai-integration
devin-ai-integration Bot force-pushed the devin/1753685736-fix-ssh-gateway-bindaddr branch from 632dd46 to 42ab433 Compare July 28, 2025 07:15
@fatedier
fatedier merged commit e6dacf3 into dev Jul 28, 2025
2 checks passed
@fatedier
fatedier deleted the devin/1753685736-fix-ssh-gateway-bindaddr branch August 10, 2025 14:51
nebulabox added a commit to nebulabox/frp that referenced this pull request Sep 9, 2025
* commit '22ae8166d31d39e09fe2d06f82d23b4433c49a33': (129 commits)
  bump version to v0.64.0 (fatedier#4924)
  improve random TLS certificate generation (fatedier#4923)
  update sponsor info (fatedier#4917)
  Fix SSH tunnel gateway binding address issue fatedier#4900 (fatedier#4902)
  update golangci-lint version (fatedier#4897)
  fix webserver port not being released on frpc svr.Close() (fatedier#4896)
  add tokenSource support for auth configuration (fatedier#4865)
  Update quic-go dependency from v0.48.2 to v0.53.0 (fatedier#4862)
  update .golangci.yml (fatedier#4848)
  update golangci-lint version (fatedier#4817)
  update test package (fatedier#4814)
  add proxy protocol support for UDP proxies (fatedier#4810)
  feat: support YAML merge in strict configuration mode (fatedier#4809)
  fix: type error in server_plugin doc (fatedier#4799)
  build: add x64 openbsd (fatedier#4780)
  update release notes (fatedier#4772)
  vnet: fix issues (fatedier#4771)
  update feature gates doc (fatedier#4755)
  vnet: update tun_unsupported function (fatedier#4752)
  virtual-net: initial (fatedier#4751)
  ...

# Conflicts:
#	.github/workflows/build-and-push-image.yml
#	.github/workflows/golangci-lint.yml
#	.github/workflows/goreleaser.yml
#	.github/workflows/stale.yml
#	pkg/util/version/version.go
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SSh tunnel gateway fails to connect with proxy bind address given 127.0.0.1

1 participant