1

So, I have multiple devices connected to my router via ethernet cables. All devices have some kind of SSH-service running and are reachable over the WAN/Internet via "ssh [email protected]".

I also set up a dynDNS service for my router, so i can reach it without having to know the exact public IPv4 adress, since it is dynamically assigned (changing in cyclic intervals).

Problem: Now, all devices have an SSH server listening on their port 22 inside the LAN. I need to find a way, how I can access these devices from the Internet/WAN and that in a relatively secure manner.

How do I do this?

1
  • Port forward to the individual devices on separate ports. You will have to configure the SSH daemon to be on different ports.
    – Ramhound
    Commented Apr 4, 2022 at 11:48

2 Answers 2

1

Only 1 device can have a port-forward for port 22 defined.
For the others you will have to setup different port-forwards on your router that gives each device a different port-number on the public ip-address and forwards to port 22 on the device's internal ip-address.

E.g:
public-ip:22 -> device1:22
public-ip:222 -> device2:22
public-ip:223 -> device3:22

In order to connect to device3 you would do ssh user@public-ip:223

-1

Today, about half a year of extensive IT training with a steep learning curve later, this is a very easy question to answer.

This is a simple sketch about how to do this: (WAN = Wide Area Network, everything on the "internet side" of your router; LAN = Local Area Network, everything inside your home network connected to your router)

WAN______________________LAN______________

|-> external port 22000 -> port 22 of device Nr. 0

|-> external port 22001 -> port 22 of device Nr. 1

|-> external port 22002 -> port 22 of device Nr. 2

|-> external port 22003 -> port 22 of device Nr. 3

The system behind this is called "port-mapping" and "port forwarding". In some router settings you can find this under "permit access" or "port redirection".

The idea is, that the router scans all incoming traffic from the WAN side and routes it (through its firewall) to the right devices on the LAN side of things. Since all connected devices listen to port 22 by default, you can tell your router to request multiple different ports on the WAN side (for example the mentioned 22000, 22001, 22002, etc.) and map them to the according ports of the devices on the LAN side, so the router receives for example traffic on port 22001 and redirects this traffic through the firewall over port 22 in the device Nr. 1, so it receives what it needs.

The exact process of how to do this is somewhat different amongst the large varieties of (home-)router brands (in non-consumer settings, the directing of the traffic would be the switches job).

Usually you should find a setting that looks somewhat like this:

For connected to permit port through and request port externally.

You can say for example:

For device_1 connected to 91.233.142.110 (arbitrary IP) permit port 22 through 22 and request port 22001 externally.

This setting would do two things:

allow traffic from the WAN to pass through the routers firewall (security risk - read last part on that)

make sure, that all traffic on the external port (from the internet) 22001 will be mapped to port 22 of device_1

With that, the problem is solved. You can do this with multiple external ports that are mapped to the according device ports and permitted through the firewall to your devices.

But beware the evil out there! The firewall is in place to protect your LAN from unwanted and potentially harmful traffic. So you should be advised on how to put security measures in place, that make sure your LAN is as secure as possible and not attackable for hackers out there.

Related methods are for example to only permit a VPN connection or using RSA-key authentication for your SSH-logins. Make sure to read up on a guide on network-device-hardening to protect your server/NAS from any bad people out there!

(There is also another way to adress this issue: Changing the default ports the programs in question (in this case the SSH-servers) are listening to and to ditch the port-mapping with it, but when I had this problem back then, I had no idea of what the junk an sshd or port even is, so I kept it relatively simple for any newcommers, since configuring a home router is in almost all cases GUI based and you don't have to mess around with config files, nano/vim or in general this scary black window we call the terminal :)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .