I want to connect (using ssh) two remote computers in a local network using a unique public IP X.X.X.X.

HOST_A---------|    |          _____________
               |---------|ROUTER PUBLIC|-----------|INTERNET|-------------|CLIENT
               |         _______________                                      
               |       X.X.X.X
HOST_B---------| |

My public IP has restriction in port 22 so I'm using the port 1234. The router port-forwarding 1234 is enable and directed to HOST_A. Currently, I can access to HOST_B from client executing

$ ssh -p 1234 user@X.X.X.X

Howerver, I can not access to HOST_B and I don't understand how to use -R and -L option of ssh. I read and follow many examples in the web and I can not achieve HOST_B without login in HOST_A previously.

I appreaciate an explanation about TCP-forwarding because I'm not sure about if it is possible to login in HOST_B using the ip X.X.X.X without configuring HOST_A.

An instance of my search: How to setup ssh tunnel to forward ssh?

  • Can you explain what restrictions you have with public IP X.X.X.X? The usual restriction is that you have just ONE public IP. Less common but still very real is you cannot use certain commonly attacked ports. But do you also have restrictions that you can only use one port on it (1234)? One of the answers below suggests using a 2nd port number (1235) and directing that to host B. You have also not explained is what port number is being used between the router and the hosts. Is that 1234 or 22? – Skaperen Feb 9 '13 at 1:07

I think the better you can do is open 2 ports on router and redirect them; one for host_a like you has done, and other, for example 1235, to host_b. So you can use

ssh -p 1234 user@X.X.X.X for host_a and

ssh -p 1235 user@X.X.X.X for host_b

  • Thanks @Brigo but I can't do that due to network restrictions over the X.X.X.X – user43010 Feb 8 '13 at 23:58
  • you can redirect the router port to one host, not both. The router is sending traffic from port 1234 to host_a, so host_b dont see it. If you cant use another port, you best workarround is connect to host_b from host_a like mossy said. – Brigo Feb 9 '13 at 0:17
  • You can set up redirects for two different ports (on its one public IP) to go to specified host/port combinations. E.g. port 1234 going to hostA/22 and port 1235 going to hostB/22. MOST routers with forwarding can do this. A few cannot by bad design. – Skaperen Feb 9 '13 at 1:12

alternative solution to solve this, to access SSH shell to your computer without IP Public from desktop or just a smart phone (e.g. Android) by installing robotito in your computer that u want to access SSH remotely.

  • This will allow you to access SSH using from Google Talk Client Apps anywhere.
  • There is no need for a public IP address or special setting.
  • I'ts Free and Open Source, Not Paying any application services anymore.
  • No need to open SSH port (keep your computer save)
  • No need to open any tunneling (e.g. VPN or somethink like that)

I made a script (tested on my raspbian OS in Raspberry Pi) so u can easily install robotito on Raspberry Pi, Debian or Ubuntu Box(debian package distribution). this is the steps to get your linux box remotable:

  1. Open Shell Command or u can call it Terminal, go to your home folder, Download installer script by command :

    $wget https://opengateway.googlecode.com/files/robotito

  2. after that running the script by entering command :

    $sudo ./robotito

  3. and then you can edit file credentials.rb from config folder if robotito using your gtalk account and save it by pressing ctrl+x and y . Default is using nano editor.

  4. running the robotito from robotito folder by command

    $cd robotito

    $./jabbershd start

  5. Now that this is done you can use ssh from any google talk client, don't forget to add the robotito gtalk account to your google talk account and test it with chatting each other before using the account.


You can just log into HOST_A and then HOST_B with a single command given you have access from HOST_B from HOST_A:

ssh -tA user@HOST_A "ssh user@HOST_B"

-t will allocate a pseudotty. -A forwards your agent if you use the same rsa keys to accest HOST_A and HOST_B.

This is a simple, quick and dirty way to get a terminal on HOST_B from client.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.