I can SSH to my linux box from within my home network using it's internal IP address like Or from the outside, I can connect through my external IP address like via port forwarding on my router that I have setup to forwarding incoming connections on port 22 to the internal address However, I cannot connect via my external IP address if I am at home. This only works from outside my network. Is this universally true or a peculiarity of my particular Motorola router?


  • Superuser is probably the appropriate place for this.
    – Bill Weiss
    Sep 21, 2009 at 19:31

3 Answers 3


It's a general problem relating to NAT, and local networks. Basically, when the router rewrites to, the source address isn't rewritten, so the destination machine sends the packets straight back to the source rather than going through the router. Since the source machine wasn't expecting packets back from (instead, it wants to see them coming from, it discards those packets and nothing useful gets done.

If your router is any good, it should be configurable to do the right thing (rewrite the source address for internal-to-internal NATed traffic), but if it isn't doing it by default it probably doesn't count as "any good". Alternately, if it's featureful you should be able to setup a second internal network for your server, which will make sure all the traffic goes through the router.

  • I bought a new router (Linksys WRT54GL) and I can SSH to my DynDNS address from inside or outside my network now.
    – benmccann
    Jun 16, 2009 at 16:01

It should be possible (I've done it on my linksys router), though I'm not exactly sure why you want to do it.

First it would be worth clarifying what "cannot connect" means. Can you ping your external address and get a reply? Is sshd logging an attempt to connect? Can you telnet through the forwarded port (to prove that the port is at least open)?

  • 1
    The reason why I'd like to is so that I can always connect to my machine using the same address.
    – benmccann
    Jun 11, 2009 at 6:30

I have several machines that I manage that are behind firewalls which restrict which hosts can SSH into the network. For the most part this is not a problem as I typically have a static IP when I'm at home or in the office, but causes me no end of trouble when I'm on a remote network somewhere else. My solution was to simplify the forwarding through one of my hosts with a static IP allowed through the firewall using the ProxyCommand in my SSH client configuration. This works for me using OpenSSH, and should work with other SSH clients which support the ProxyCommand so check your client documentation if in doubt. It also requires the installation of netcat the TCP/IP swiss army knife.

Inside my ~/.ssh/config file I have the following configuration:

Host InternalHost
    ProxyCommand ssh StaticHost nc %h 22
    HostName InternatHost-FQDN

I use the short hostname to reference the configuration, allowing me to use the fully qualified domain name to reach it without using the forwarding. What this configuration does is connect to StaticHost and run netcat to forward to InternalHost-FQDN on port 22. Unless you have your SSH identity key setup to log into StaticHost & InternalHost without prompting for the password you will receive two prompts for your password entry. In my case I have my SSH identity key installed on both and load the SSH key into the SSH agent and find myself logged in without any password request prompts.

This configuration will also work to allow you to transfer files back and forth with InternalHost using the scp command just as easily as logging into the shell.

Not the answer you're looking for? Browse other questions tagged or ask your own question.