diff --git a/Release.md b/Release.md
index 7ee50ea0..9e1ce466 100644
--- a/Release.md
+++ b/Release.md
@@ -1,3 +1,7 @@
 ## Features
 
-* Support tokenSource for loading authentication tokens from files
\ No newline at end of file
+* Support tokenSource for loading authentication tokens from files
+
+## Fixes
+
+* Fix SSH tunnel gateway incorrectly binding to proxyBindAddr instead of bindAddr, which caused external connections to fail when proxyBindAddr was set to 127.0.0.1
diff --git a/server/service.go b/server/service.go
index 514afb51..fad0e143 100644
--- a/server/service.go
+++ b/server/service.go
@@ -262,7 +262,7 @@ func NewService(cfg *v1.ServerConfig) (*Service, error) {
 	}
 
 	if cfg.SSHTunnelGateway.BindPort > 0 {
-		sshGateway, err := ssh.NewGateway(cfg.SSHTunnelGateway, cfg.ProxyBindAddr, svr.sshTunnelListener)
+		sshGateway, err := ssh.NewGateway(cfg.SSHTunnelGateway, cfg.BindAddr, svr.sshTunnelListener)
 		if err != nil {
 			return nil, fmt.Errorf("create ssh gateway error: %v", err)
 		}