Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I can SSH to my linux box from within my home network using it's internal IP address like 192.168.10.2. Or from the outside, I can connect through my external IP address like 74.23.43.98 via port forwarding on my router that I have setup to forwarding incoming connections on port 22 to the internal address 192.168.10.2. However, I cannot connect via my external IP address if I am at home. This only works from outside my network. Is this universally true or a peculiarity of my particular Motorola router?

Thanks

share|improve this question

closed as off topic by MDMarra, Chris S Nov 26 '12 at 4:50

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Superuser is probably the appropriate place for this. –  Bill Weiss Sep 21 '09 at 19:31

3 Answers 3

up vote 7 down vote accepted

It's a general problem relating to NAT, and local networks. Basically, when the router rewrites 74.23.43.98 to 192.168.10.2, the source address isn't rewritten, so the destination machine sends the packets straight back to the source rather than going through the router. Since the source machine wasn't expecting packets back from 192.168.10.2 (instead, it wants to see them coming from 74.23.43.98), it discards those packets and nothing useful gets done.

If your router is any good, it should be configurable to do the right thing (rewrite the source address for internal-to-internal NATed traffic), but if it isn't doing it by default it probably doesn't count as "any good". Alternately, if it's featureful you should be able to setup a second internal network for your server, which will make sure all the traffic goes through the router.

share|improve this answer
    
I bought a new router (Linksys WRT54GL) and I can SSH to my DynDNS address from inside or outside my network now. –  benmccann Jun 16 '09 at 16:01

It should be possible (I've done it on my linksys router), though I'm not exactly sure why you want to do it.

First it would be worth clarifying what "cannot connect" means. Can you ping your external address and get a reply? Is sshd logging an attempt to connect? Can you telnet through the forwarded port (to prove that the port is at least open)?

share|improve this answer
1  
The reason why I'd like to is so that I can always connect to my machine using the same address. –  benmccann Jun 11 '09 at 6:30

I have several machines that I manage that are behind firewalls which restrict which hosts can SSH into the network. For the most part this is not a problem as I typically have a static IP when I'm at home or in the office, but causes me no end of trouble when I'm on a remote network somewhere else. My solution was to simplify the forwarding through one of my hosts with a static IP allowed through the firewall using the ProxyCommand in my SSH client configuration. This works for me using OpenSSH, and should work with other SSH clients which support the ProxyCommand so check your client documentation if in doubt. It also requires the installation of netcat the TCP/IP swiss army knife.

Inside my ~/.ssh/config file I have the following configuration:

Host InternalHost
    ProxyCommand ssh StaticHost nc %h 22
    HostName InternatHost-FQDN

I use the short hostname to reference the configuration, allowing me to use the fully qualified domain name to reach it without using the forwarding. What this configuration does is connect to StaticHost and run netcat to forward to InternalHost-FQDN on port 22. Unless you have your SSH identity key setup to log into StaticHost & InternalHost without prompting for the password you will receive two prompts for your password entry. In my case I have my SSH identity key installed on both and load the SSH key into the SSH agent and find myself logged in without any password request prompts.

This configuration will also work to allow you to transfer files back and forth with InternalHost using the scp command just as easily as logging into the shell.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.