From owner-freebsd-questions@FreeBSD.ORG Mon Sep 13 22:43:03 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 6470816A4CE; Mon, 13 Sep 2004 22:43:03 +0000 (GMT) Received: from out002.verizon.net (out002pub.verizon.net [206.46.170.141]) by mx1.FreeBSD.org (Postfix) with ESMTP id D8D7243D67; Mon, 13 Sep 2004 22:43:02 +0000 (GMT) (envelope-from cswiger@mac.com) Received: from [192.168.1.3] ([68.160.193.218]) by out002.verizon.net (InterMail vM.5.01.06.06 201-253-122-130-106-20030910) with ESMTP id <20040913224302.GUGG6722.out002.verizon.net@[192.168.1.3]>; Mon, 13 Sep 2004 17:43:02 -0500 Message-ID: <41462266.9000404@mac.com> Date: Mon, 13 Sep 2004 18:42:46 -0400 From: Chuck Swiger Organization: The Courts of Chaos User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.2) Gecko/20040803 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Mark Ovens References: <41460E03.8020408@freebsd.org> In-Reply-To: <41460E03.8020408@freebsd.org> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Authentication-Info: Submitted using SMTP AUTH at out002.verizon.net from [68.160.193.218] at Mon, 13 Sep 2004 17:43:01 -0500 cc: freebsd-questions@freebsd.org Subject: Re: Quick and simple ssh(1) question X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Sep 2004 22:43:03 -0000 Mark Ovens wrote: > Is it correct that you can't ssh(1) between two machines on the same LAN > (using NAT) _via the Internet?_ > > Strange question I know, but I need to be able to access one of my > machines, postie, remotely. I've got sshd(8) running and can ssh(1) to > it from a local machine using it's local hostname. However, since I only > have a single 'net connection here I tried to test connecting remotely > by ssh(1)'ing to my router's 'net-facing hostname but I get > > ssh: connect to host port 22: Connection refused > > Port 22 is forwarded to postie on the router. Given time and sufficient determination, you ought to be able to make this work, but it's a real pain-- you need to set up an IP alias on postie for the public IP, not just your internal NAT address, you need to watch out for any anti-spoofing rules and anything blocking the RFC-1918 unroutable IPs commonly used with NAT on the machines involved, and you may even have to set up a host-specific route for the public IP to the NIC/subnet where the machine actually is on your router, as well (if that isn't already implied by the router when forwarding ports to a box, or marking an IP as the "DMZ host", etc, depending on what your router is). Using "split DNS" to return a local IP rather than a public IP when a machine on your LAN asks for a public name is easier to set up. -- -Chuck