I have two systems sitting on a NATed network.

When I forward port 22 to system A, I am able to connect directly.
When I forward port 22 to system B, I am not able to connect.
I am, however, able to SSH from system A to system B.
I have tried disabling the firewall on system B.

I'm at a bit of a loss as to what could be wrong.
Are there tests I could run to help me identify the root of the problem?

2 Answers 2


I'd say there is one other possibility besides the ones that Alex mentions, and that is that your port forwarding box is the gateway for system A, but not for system B.

  • Looking at the routing tables, your suggestion that the issue might be with the systems using different gateways is promising - system B connects to a VPN which has complicated the routing table a fair bit. Is there any way to override this based on the incoming gateway?
    – Li1t
    Jan 15, 2015 at 10:53
  • It depends, if it's a linux system, ensuring that traffic goes back out on the interface it came in on can be ensured with a few different methods, policy based routing, or firewall marks can help ..
    – NickW
    Jan 15, 2015 at 11:15
  • Thanks, I'll look into this (I would vote your answer up too, but I have no rep on ServerFault yet)
    – Li1t
    Jan 16, 2015 at 17:11

There is not enough information to close in on a specific issue; I suppose the port forwarding you are asking about is the one on the NAT box, and not the SSH port forwarding feature.

If this is the case there may be at least two reasons for this behaviour; one is that box A and B have several IP addresses (say, box A is and and box B is and and the ssh connection from A to B happens on the one the ssh server on B is listening on, while the NAT box is only on the other network (the one on which the SSH server on B is not listening). This means that the SSH server on A is listening on both networks while the one on B is listening only on the network the NAT doesn't forward packets to.

The other reason may be a difference in accepted encryption/key exchange protocols, in which the SSH client on box E (external to the network, being used to test) accepts encryption protocol P1, SSH server on box A accepts protocols P1 and P2, SSH client on box A accepts protocols P1 and P2 and SSH server on box B accepts protocol P2 only. In this case I believe the error message sould be different from the one in the not-able-to-connect case, but again I don't know the software involved.

Please add more details to the question, such as addresses and software.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.