SSH through Home Router with Port Forwarding [closed]

Question

I can SSH to my linux box from within my home network using it's internal IP address like 192.168.10.2. Or from the outside, I can connect through my external IP address like 74.23.43.98 via port forwarding on my router that I have setup to forwarding incoming connections on port 22 to the internal address 192.168.10.2. However, I cannot connect via my external IP address if I am at home. This only works from outside my network. Is this universally true or a peculiarity of my particular Motorola router?

Thanks

Answer 1

It's a general problem relating to NAT, and local networks. Basically, when the router rewrites 74.23.43.98 to 192.168.10.2, the source address isn't rewritten, so the destination machine sends the packets straight back to the source rather than going through the router. Since the source machine wasn't expecting packets back from 192.168.10.2 (instead, it wants to see them coming from 74.23.43.98), it discards those packets and nothing useful gets done.

If your router is any good, it should be configurable to do the right thing (rewrite the source address for internal-to-internal NATed traffic), but if it isn't doing it by default it probably doesn't count as "any good". Alternately, if it's featureful you should be able to setup a second internal network for your server, which will make sure all the traffic goes through the router.

Answer 2

It should be possible (I've done it on my linksys router), though I'm not exactly sure why you want to do it.

First it would be worth clarifying what "cannot connect" means. Can you ping your external address and get a reply? Is sshd logging an attempt to connect? Can you telnet through the forwarded port (to prove that the port is at least open)?

Answer 3

I have several machines that I manage that are behind firewalls which restrict which hosts can SSH into the network. For the most part this is not a problem as I typically have a static IP when I'm at home or in the office, but causes me no end of trouble when I'm on a remote network somewhere else. My solution was to simplify the forwarding through one of my hosts with a static IP allowed through the firewall using the ProxyCommand in my SSH client configuration. This works for me using OpenSSH, and should work with other SSH clients which support the ProxyCommand so check your client documentation if in doubt. It also requires the installation of netcat the TCP/IP swiss army knife.

Inside my ~/.ssh/config file I have the following configuration:

Host InternalHost
    ProxyCommand ssh StaticHost nc %h 22
    HostName InternatHost-FQDN

I use the short hostname to reference the configuration, allowing me to use the fully qualified domain name to reach it without using the forwarding. What this configuration does is connect to StaticHost and run netcat to forward to InternalHost-FQDN on port 22. Unless you have your SSH identity key setup to log into StaticHost & InternalHost without prompting for the password you will receive two prompts for your password entry. In my case I have my SSH identity key installed on both and load the SSH key into the SSH agent and find myself logged in without any password request prompts.

This configuration will also work to allow you to transfer files back and forth with InternalHost using the scp command just as easily as logging into the shell.