Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to setup port forwarding for ssh through 2 NATs

The first Router translates my internet IP to my outer network ( In the outer network there's a second Router that does NAT to my inner network (

The target server is connected to both, the outer network and the inner network.

I cannot change the port forwarding options for outer router. It is currently configured to forward the SSH and HTTP port to the router for the inner network.

            +-----------------+                      +------------------+
            |  Outer Router   |                      |   Inner Router   |
            |-----------------|                      |------------------|
            |                 |       SSH HTTP       |                  |
       +----+                 +--------------------->|                  |
       |    |                 |                      |                  |
       |    |                 |                      |                  |
       |    +-------+---------+                      +------+---------+-+
       |            |                                       |         |
       |            |                                       |         |
       |            |                                       |         |
       |            |           +------------------+        | SSH     |
       |            |           |   Server         |        |         |
       |            |           |------------------|        |         |
       |            +----------->                  |<-------+         |
       |                        |                  |                  |HTTP (testing)
       |                        +------------------+                  |
       |                                                              |
+------v------------------+                                           |
|  Outer Workstation      |     +-------------------+                 |
|-------------------------|     |  Inner Workstation|                 |
|                         |     |-------------------|                 |
|                         |     |                   |<----------------+
+-------------------------+     |                   |

When connecting from a outer workstation to the address of the inner router, then both SSH and HTTP work fine.

When connecting from the internet to my public ip with HTTP, the connection works fine as well.

However SSH just times out. Most likely because the reply is not routed back properly.

I suspect its either because of the SSH itself, or because the server is connected to both, the inner and outer network.

Any ideas how I could resolve this issue?

The routes on the server are currently:

ip route show
default via dev eth0  metric 100 dev eth0  proto kernel  scope link  src dev eth1  proto kernel  scope link  src

Do I have to change this? If so how?

share|improve this question
How is the outer workstation connected to the outer router, if not thru the internet? Is this a vpn where you didn't push the right route? – ott-- Jul 3 '12 at 20:30
@ott-- by "outer" I mean on the outer network, which is still a LAN. It is connected to in the same way as the Inner Router and the server on eth0. There is no VPN involved. – d_inevitable Jul 3 '12 at 20:31
The inner router has 2 interfaces, one with 10.x and the other with 192.168.1.x? Ant the inner server has 2 interfaces too? – ott-- Jul 3 '12 at 20:47
@ott-- yes, that's correct and both interfaces are on the same switch. Yes the server has 2 interfaces too. – d_inevitable Jul 3 '12 at 20:48
Now the final question: the inner workstation has a webserver that you can reach from the outer workstation? – ott-- Jul 3 '12 at 21:31
up vote 1 down vote accepted

Such lack of behaviour can be caused by asymmetric routing and the feature of the outer router that forbids it. Server routes the ssh replies back through the other connection (using its default gateway to the internet) and the outer router drops the packet. Try monitoring the traffic with iptraf or tcpdump and see on which wire of the server the packets get output. Iptraf has a connection view with packets shown in the lower part of the screen. You may have to add a source NAT rule to your inner router to make the SSH packets come back the right way.

Edit: the connection from the outer workstation does not go through the outer router. It just connects directly to the inner router with an ip from the same subnet and can receive packets directly from the outer interface of the server as this is on the same subnet too.

To clarify this, think how the appropriate NATs work. When a packet is received to the SSH port from the internet by the outer router, its "TO" address and port get rewritten to the appropriate values of the inner router. The "FROM" address of the packet remains unchanged. The inner router receives the packet and rewrites the TO address and port yet again, but the FROM address remains the same, the original routable IP address the SSH packet came from. The inner router passes the packet on to the server (if all your port forwarding is correctly configured), the sshd in the server receives it and sends a reply out directly to the outer router. If the outer router is configured to drop asymmetrically routed packets, it will see that the sender does not have the address of the inner router and will recycle it in the big bin. SNAT or source NAT in the inner router would rewrite the FROM address in such a way that the server would return the packet to the inner router, that in turn to the outer router and the latter to the original sender.

share|improve this answer
Hmm I can't seem to find any incomings with tcpdump. Tried sudo tcpdump -i eth1 | grep 2222 (2222 is the ssh port). What do you mean by setting a default router out? – d_inevitable Jul 3 '12 at 20:22
Where would this setting be on a linux server? Why wouldn't it just reply through the gateway that corresponds to the incoming packet's IP? – d_inevitable Jul 3 '12 at 20:28
That makes sense now, thank you. I've updated my question with the route configuration of the server. Do I have to change that configuration. If so, how? iptraf doesn't seem to show much useful info as it seems to only report on established connections. This never happens in this case. – d_inevitable Jul 3 '12 at 20:45
I think your hypothesis is very plausible, but I simply cannot find those incoming packets. Tried it through http too, which is confirmed to be forwarded properly by the outer router. But then there is absolutely no reason why the server shouldn't be getting the packets. So I think my method of detecting the packets is still not correct. I've tried it with sudo tcpdump -i eth1 port 2222 and sudo tcpdump -i eth1 host x.x.x.x. Neither detects any packets at all. – d_inevitable Jul 3 '12 at 21:16
yeah that only seems to show active connections, not packets. – d_inevitable Jul 3 '12 at 21:39

If the server is connected to both networks can you forward the port from the outer NAT device (I presume this is the server's gw) directly to the server?

share|improve this answer
Sorry it didn't make it clear enough. I cannot change settings on the outer router. (Went through a lot of trouble to get my isp set up some forwarding at all). – d_inevitable Jul 3 '12 at 20:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.