Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to connect (using ssh) two remote computers in a local network using a unique public IP X.X.X.X.

HOST_A---------|    |          _____________
               |---------|ROUTER PUBLIC|-----------|INTERNET|-------------|CLIENT
               |         _______________                                      
               |       X.X.X.X
HOST_B---------| |

My public IP has restriction in port 22 so I'm using the port 1234. The router port-forwarding 1234 is enable and directed to HOST_A. Currently, I can access to HOST_B from client executing

$ ssh -p 1234 user@X.X.X.X

Howerver, I can not access to HOST_B and I don't understand how to use -R and -L option of ssh. I read and follow many examples in the web and I can not achieve HOST_B without login in HOST_A previously.

I appreaciate an explanation about TCP-forwarding because I'm not sure about if it is possible to login in HOST_B using the ip X.X.X.X without configuring HOST_A.

An instance of my search: How to setup ssh tunnel to forward ssh?

share|improve this question
Can you explain what restrictions you have with public IP X.X.X.X? The usual restriction is that you have just ONE public IP. Less common but still very real is you cannot use certain commonly attacked ports. But do you also have restrictions that you can only use one port on it (1234)? One of the answers below suggests using a 2nd port number (1235) and directing that to host B. You have also not explained is what port number is being used between the router and the hosts. Is that 1234 or 22? – Skaperen Feb 9 '13 at 1:07

I think the better you can do is open 2 ports on router and redirect them; one for host_a like you has done, and other, for example 1235, to host_b. So you can use

ssh -p 1234 user@X.X.X.X for host_a and

ssh -p 1235 user@X.X.X.X for host_b

share|improve this answer
Thanks @Brigo but I can't do that due to network restrictions over the X.X.X.X – user43010 Feb 8 '13 at 23:58
you can redirect the router port to one host, not both. The router is sending traffic from port 1234 to host_a, so host_b dont see it. If you cant use another port, you best workarround is connect to host_b from host_a like mossy said. – Brigo Feb 9 '13 at 0:17
You can set up redirects for two different ports (on its one public IP) to go to specified host/port combinations. E.g. port 1234 going to hostA/22 and port 1235 going to hostB/22. MOST routers with forwarding can do this. A few cannot by bad design. – Skaperen Feb 9 '13 at 1:12

You could configure SSH on client B to use a different port. Doing that would allow you to have two different forward rules.

Another option is connecting to host_B from Host_A's session.

note You will want to make sure that you're using STATIC IP's for these machines. If you use DHCP, you're going to be SOL when your routers reassigns IP's.

ssh from Host_A

This will allow you to connect from host_B from host_A

From Host_A you can run ssh -p 123 user@local_IP

There is no need for another user account. You can have two sessions active at the same time.

Port forwarding

I will go a little more in depth with what is going on here because it seems you're confused on the forwards. (Or I'm a complete retard and misread your question).

From your client you're going to be dealing with 1 single IP address. The public IP. All of your traffic is going to hit the router first, and the router then decides where to sent it. This is where the port forwarding come into play.

The follow image shows where you set these specific "route rules" PortFoward

You would need to add Host_A with it's own individual SSH port along with Host_B's port.

Once you have done this, your router will know (based on the port you're using) where to send your request.

share|improve this answer
I don't want to create another user account in HOST_A unless it is necessary – user43010 Feb 9 '13 at 0:02
Currently, I am using your firts option but I want to know if it is possible another solution without: a) Create a user-account b) use another port (networking restrictions) – user43010 Feb 9 '13 at 0:52
If you don't have access to the router configuration, then no I don't know of a way. – QuentinMoss Feb 9 '13 at 0:59
Please explain the network restriction you have. There are SO MANY possibilities. – Skaperen Feb 9 '13 at 1:33

alternative solution to solve this, to access SSH shell to your computer without IP Public from desktop or just a smart phone (e.g. Android) by installing robotito in your computer that u want to access SSH remotely.

  • This will allow you to access SSH using from Google Talk Client Apps anywhere.
  • There is no need for a public IP address or special setting.
  • I'ts Free and Open Source, Not Paying any application services anymore.
  • No need to open SSH port (keep your computer save)
  • No need to open any tunneling (e.g. VPN or somethink like that)

I made a script (tested on my raspbian OS in Raspberry Pi) so u can easily install robotito on Raspberry Pi, Debian or Ubuntu Box(debian package distribution). this is the steps to get your linux box remotable:

  1. Open Shell Command or u can call it Terminal, go to your home folder, Download installer script by command :


  2. after that running the script by entering command :

    $sudo ./robotito

  3. and then you can edit file credentials.rb from config folder if robotito using your gtalk account and save it by pressing ctrl+x and y . Default is using nano editor.

  4. running the robotito from robotito folder by command

    $cd robotito

    $./jabbershd start

  5. Now that this is done you can use ssh from any google talk client, don't forget to add the robotito gtalk account to your google talk account and test it with chatting each other before using the account.

share|improve this answer

You can just log into HOST_A and then HOST_B with a single command given you have access from HOST_B from HOST_A:

ssh -tA user@HOST_A "ssh user@HOST_B"

-t will allocate a pseudotty. -A forwards your agent if you use the same rsa keys to accest HOST_A and HOST_B.

This is a simple, quick and dirty way to get a terminal on HOST_B from client.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.