ssh - Port Forwarding a Specific Port (e.g. 22)

I'm still confused about establishing an SSH connection (port 22) between two computers on different internal networks. For example: I am on my computer with internal IP address IIP-1, connected to my router RT-1. There are 10 IIPs connected to RT-1. I want to establish an SSH connection to IIP-3 which is connected to router RT-2. There are 10 IIPs connected to RT-2. At any time, there can be multiple SSH connections between IIPs on RT-1 and RT-2. Since I only have port 22 available, I don't know which SSH session is talking between which IIPs. I looked at a couple of similar questions but am still unclear on the solution. Thanks much, Jerry

If you have a router with a single public IP address on the WAN side, and uses a subnet of private IP addresses on the LAN side, it's more than a router, it's a NAT (technically NAPT: Network Address and Port Translation, but most people just say NAT) gateway.

When a host attempts to start a new connection, it sends the packet from an ephemeral port number (above 49152). As the NAT gateway processes this outgoing packet, it looks to see if that source port is free on the NAT gateway's WAN interface (public IP address). If it's free, it lets that client use that port number; if it's in use, it assigns a different public port number to that packet and modifies the packet to make it look like it came from that other port number. Either way, it makes a table entry mapping that public port number to that private IP address and port, so it can properly translate and forward any further packets on that connection, in either direction.

For new incoming connection attempts on its public IP address, the NAT gateway can't automatically know who to forward the connection attempt to. So the NAT gateway would drop the packet by default, and possibly respond with a TCP Reset packet or an ICMP "Destination Unreachable: Port Unreachable" message. So that's why you have to create port forwarding (a.k.a. port mapping, virtual server, etc.) rules.

But a single port, like ssh's well known port 22, can only be forwarded to a single host. So for connections initiated from the outside, only one host can be reached at port 22. So if you have more than one machine behind a NAT gateway, and you want them all to be reachable via ssh from the outside, you'll need to pick other port numbers to map to those hosts. For example, map public port 22 to port 22 on the first host, then map public port 50022 to port 22 on the second host, then map public port 50122 to port 22 on the third host, etc.

Then, when you need to connect to, say, the second host, use ssh -p 50022 username@PublicIPAddrOfNATGateway.

Actually, it's probably best if you don't map public port 22 to anything. ssh's port 22 is one of the most-attacked ports. Using some other port doesn't make you more secure, but it does make you less likely to see as many attacks.

I don't really understand your question because you know there are multiple SSH sessions.

I don't see where routers come into it. Because you'd have the same question if there was just one router.

I don't see why it matters to your question whether they are internal or external IPs..

You have multiple connections to an SSH server from different computers.

I suppose each is distinct in that one is logged on as one user, one as another user.

And each is distinct in being initiated by a different IP.

And if one computer can initiate multiple connections, then you can say each connection is distinct by being initiated by a different IP:PORT

All the private IPs (what you call IIPs) on R1, are different IPs to the IPs on R2.

BUT....

Let's suppose that isn't so.. (which is I think what you are getting at)

Let's suppose, that some computers on R1 have the same IP as some computers on R2.

Then R1 and R2 have to bqe doing NAPT. (NAPT is NAT but also one to many). So the SSH server communicates with R1's IP address and R2's IP address. Each connection is at a different port..

So each sSH session, from the SSH server's perspective, which is a good perspective to be looking from.. as it sess all the connections to it. Each ssh session can be identified by IP:PORT where IP is R1's IP or R2's IP. And whatever port.

It's Port Translation you are talking about not really port forwarding.

If you have multiple computers behind a NAPT router and they're accessing the Internet, that doesn't require port forwarding, but it does require port translation. The website just sees the NAPT Router's IP. The NAPT router distinguishes each connection, as it opens local client ports up to communicate with the websites, and any local client port it opens up is going to be associated with one of the private IPs connected to it.

You wouldn't normally want NAPT locally, that is insane. You have enough private IPs!