10 thoughts on “SSH: Conditional host address based on network or location”

1. Great solution. I had the same problem. Thank you very much…

   Reply ↓

2. Thanks for the detailed writeup. I just need to get to my home servers when I’m traveling, and this is great solution. I use iTerm with Profiles, and this way, I don’t have to have duplicate profiles set up. Very clean.

   Reply ↓

3. Thanks, this works really well and easier than specifying multiple local/remote entries

   Reply ↓

4. I have done something similar in the past but for a different reason. When I want to access my home server I’m either at home, or not. If I’m at home I have to use my local IP, this is because my home router does not support NAT Loopback (https://support.google.com/wifi/answer/6274503?hl=en). By using the same method you have above, but with a different cmd, I’m able to detect if I’m on my home network. (IP addresses changed for example)
   “`
   Match OriginalHost server-a Exec “curl -s ‘https://api.ipify.org?format=text’ | grep ‘10.2.1.1’”
   Hostname 192.168.1.2
   Host server-a
   Hostname 10.2.1.1
   “`
   I went with this solution because many home routers use the same subnet so simply checking if I’m on “192.168.1.0/24” wouldn’t work as I’d get too many false positives.

   Reply ↓

5. THANKS!

   I love this solution. I found it more useful for my setup to check WIFI hotspot name in the condition using nmcli command.

   Match host some-host Exec “nmcli -g NAME connection show –active | grep accelico”

   Reply ↓

6. Thanks!!

   Reply ↓

7. I have been doing something different, but I’m going to experiment with your ideas, they seem interesting and a better solution that I came up with.

   For my solution I did something like this:

   Host *.example.com # No final period
   ProxyJump gateway.example.com. # Note the final period!

   For the “switch” for inside example.com vs outside, I manually appended a final period or not. Thus from outside:

   ssh my_desktop.example.com

   or from inside:

   ssh my_desktop.example.com. # final period

   My solution was not automatic, I had to be aware of my location and add the final period. I’m implementing your solution now.

   Thanks much!

   Reply ↓

8. I also used the SSH ‘Match’ option to figure out which network I’m on, and set either ‘Hostname’ (for my home network gateway machine) or ‘ProxyJump’ (to reach any machine inside my home network by using my gateway machine as a proxy if I’m on the outside). I also added some ‘LocalCommand’ to alert me of what’s going on when I’m connecting via SSH (piped to STDERR with ‘>&2’ so as to not disrupt rsyncing), and a special rule for when I ssh:ing to localhost.

   The following shell command “{ ip neigh; ip link; }|grep -Fw 60:0e:56:36:c4:ca” returns true if it is run on a machine any in my network, since my gateway machine (luthor) has the MAC address 60:0e:56:36:c4:ca. The ‘ip neigh’ will list the machines that localhost is aware of on the local network, except localhost itself, while ‘ip link’ will display information about localhost. Grepping over both of these the IP of the gateway machine will be found in the output of ‘ip link’ if the SSH command was run on the gateway machine itself, or in the output of ‘ip neigh’ if the SSH command was run on one of the other machines in my home network.

   Is a shell command “[ %h = %L ]” (expanded by SSH) which returns true if the local hostname (%L) is the same as the remote hostname (%h). (The %-options are documented in manpage ‘ssh_config’.)

   # For gateway machine.
   # If ‘ssh luthor’ when SSH:ing from outside of my home network, the ‘Hostname’
   # is set to my dyndns-domain, otherwise ‘Hostname’ will be unmodified (i.e.
   # just ‘luthor’).
   Match originalhost luthor exec “[ %h = %L ]”
   LocalCommand echo “SSH %n: To localhost” >&2
   Match originalhost luthor !exec “[ %h = %L ]” !exec “{ ip neigh; ip link; }|grep -Fw 60:0e:56:36:c4:ca”
   LocalCommand echo “SSH %n: From outside network, to %h” >&2
   Hostname luthor.dyndns.org
   Host luthor
   PermitLocalCommand yes
   LocalCommand echo “SSH %n: From home network, to %h” >&2

   For the other machines on my local network instead set the ‘ProxyJump’ option to my gateway (luthor) if I’m SSH:ing in from outside my home network. If I’m at home, this won’t work (because my router will block the connection) but then there is no need for a ‘ProxyJump’ as I can connect directly.

   The gateway ‘luthor’ is the only machine on my home network which visible to the internet. The machine ‘vorlon’ is behind the NAT, and from outside my home network it can only be reached through ‘luthor’ (either by running ‘ssh -t luthor ssh vorlon’, or as below by setting ‘ProxyJump’ – One can also use the SSH ‘ProxyCommand’ setting, but I haven’t tested that).

   Match originalhost vorlon exec “[ %h = %L ]”
   LocalCommand echo “SSH %n: To localhost” >&2
   Match originalhost vorlon !exec “[ %h = %L ]” !exec “{ ip neigh; ip link; }|grep -Fw 60:0e:56:36:c4:ca”
   LocalCommand echo “SSH %n: From outside network, via proxy luthor” >&2
   ProxyJump luthor
   Host vorlon
   PermitLocalCommand yes
   LocalCommand echo “SSH %n: From home network” >&2

   Reply ↓

   • Oh, yes, originally I experimented by using ‘iwgetid -r|grep SSID’ to detect which wifi I was connected to, but I sometimes use an ethernet cable, and I wanted something that would allow for that too (which the above stuff do, at least on my setup).

     Reply ↓

9. I like the match!
   I’ve also used a shell script for the ProxyCommand
   The shell script can examine it’s environment do more than one line.
   Then a case statement can invoke ssh or nc (netcat)
   The downside with netcat is that you need to be careful of ssh fingerprinting (your end box should have the same key deterministically)
   Thank you for the write up (yes 6 years later).

   Reply ↓

This site uses Akismet to reduce spam. Learn how your comment data is processed.