1

Hi so we have multiple machines on our network running ssh on port 22, because of this we set up port forwarding in the router as 22->22 for one of the machines and 222->22 on the other machine. The one that is set up to be 222 for the outside world will not allow us to connect to the machine unless its outside port is also 22 thus making us disable outside access to the first machine. Is there some sort of config that disables access for this type of situation?

Desired Functionality:

Outside----P22----->router-----P22----->Machine1 (Currently Works)
Outside----P222---->router-----P22----->Machine2 (Returns Connection Refused)

Only port 22 on the outside to either machine (with the other disabled) has worked so far.

Router: Linksys E2500

7
  • Could you please explain what do you mean by "The one that is set up to be 222 for the outside world will not allow us to connect to the machine unless its outside port is also 22 thus making us disable outside access to the first machine."?
    – Matteo
    Feb 11, 2014 at 16:29
  • Ok so machine 1 in this situation is set up to be accessed through our router from the outside on port 22. machine 2 is set up to use 222 from the outside and the router should deliver it on the inside to 22 to the correct server. When I try to connect to machine 2 when it is set to use 222 I get a connection refused from putty, however if I temporarily disable machine 1 and change machine 2 to use 22 on the outside instead of 222 I can connect just fine to machine 2
    – csteifel
    Feb 11, 2014 at 16:34
  • Do you mean that you are trying to connect to machine 2 from machine 1 using port 222?
    – Matteo
    Feb 11, 2014 at 16:36
  • try using 2222 instead of 222 to forward to machine 2.
    – user9517
    Feb 11, 2014 at 16:59
  • 1
    Can you please post the relevant rule-sets from your firewall / router? Without knowing if this is a Cisco Router /w ASAs and ACLs, or a Linux iptables based router, or a best buy consumer router it is going to be next to impossible to help you. Right now all we know is that EITHER the ROUTER or Machine2 is throwing the 'connection refused' message... Feb 11, 2014 at 18:20

2 Answers 2

2

Instead of punching multiple holes in your router you may decide to use the following trick:

  1. open a connection to the first machine in one terminal window with the following command:

    ssh -L 10022:machine-2-local-ip:22 user-on-machine-1@router

  2. open another terminal window and you will be able to securely connect to machine-2 using

    ssh -p10022 user-on-machine-2@0

To describe it in plain English:

The first command starts up an ssh session with the router on port 22 and sets up ssh port-forwading binding your localhost's port 10022 to the machine-2-local-ip address on port 22 (as visible from the router). So, if you have proper internal DNS or a name defined in /etc/hosts on the router you can use a name in place of machine-2-local-ip, otherwise use the internal IP address of the second machine there.

The second command connects to port 10022 on your localhost. This port is forwarded through the established ssh session in step 1 to machine-2. :)

Hope this helps.

0

I've been in this situation before with multiple systems wanting to use the same ports through a NAT router. By far the easiest solution is to set the ports both locally and remotely as the same port, so:

internet -> port22 -> router -> machine 1 port 22
internet -> port222 -> router -> machine 2 port 222

I'm not saying it isn't possible, but with several consumer-grade routers I was unable to get any other configuration to stick.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .