Remote: CentOS 6, has public IP Remote<-->Internet

Local: Win10, behind NAT Local<--->Local Router--->ISP NAT--->Internet


  • Local wants to run a Service listening port 1234, but it's behind NAT so Local is not reachable to the public.
  • The Service will attempt to obtain public IP automatically.

Desired result:

  • Anyone visiting the Remote:1234 will be redirected to Local:1234.

If not, what are the other options ?

Thanks in advance !

  • In ssh it's called a reverse tunnel. I would be surprised if Putty didn't provide that too. Jul 17, 2020 at 10:56

3 Answers 3


This requirement is generally handled by a network security Engineer.

As per your post I understand that your internal hosted server wants to communicate to a remote server hosted in another network right?

Your internal hosted server should source NAT to an available static public IP allocated by ISP and we need to frame an outbound security policy in firewall as:

Source interface : inside interface of firewall
Destination interface : outside interface of firewall
Source address : server private IP(local IP)
Destination : remote server public IP
Service :TCP-1234
Action : allow
Security profiles :on

At the same time the server source NAT IP needs to be whitelisted at teh remote client, so that our traffic is allowed through the vendor firewall

Let's see the traffic flow

Step 1

When local server initiates traffic

  1. source IP is local server private IP
  2. destination IP is remote server public IP
  3. port tcp-1234

Step 2

When traffic reaches the local hosted servers network perimeter firewall, the server local private IP is translated with the sourced NAT'd public IP

The source will be a local server source NAT'd public IP and destination will be remote server public IP with port tcp-1234

Now traffic will reach to the vendor. The vendor has already whitelisted our source NAT'd IP so traffic is allowed and will access the remote server on port tcp-1234

In the same way, reverse traffic flows and our local server will be able to access resources on the remote server.

  • The Local is behind an openwrt router under my control, which is behind the ISP NAT. So I can pull off SNAT rules, but what about SNAT IP ? What should I fill in the "SNAT IP" ? Also, the ISP may change the Local's public IP from time to time.
    – 7E10FC9A
    Jul 19, 2020 at 9:03

Your can use any static public ip provided by your isp . If you don't have extra static ip from isp . You can use destination nat public ip for source nat as well . In case if server is not having destination nat public ip . Then your can use internet access ip

Example if your server is having internet access provided by your isp . In server go to browser and type "wat is my ip address " you whitelist same public ip at vendor. This is only in case when you don't have source or destination natted ip.

  • I have no control to the ISP main router so source NAT won't work
  • The Service will attempt to obtain public ip, so reverse ssh tunnel won't work


  • Remote: VPN server (I use WireGuard)
  • Local Router: VPN client
  • Remote: Port forwarding to Local Router (iptables / firewalld)
  • Local: DSCP tagging the Service
  • Local Router: Policy routing the DSCP tag to VPN interface

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .