Hi All,
I read tons of forum posts and articles, but I still can’t make it work.
I’m trying to reach an internal machine from outside my LAN using my static IP.
This is the NAT rule I added:
/ip firewall nat add action=dst-nat chain=dstnat comment=“Forward SSH for access point on port 2022” dst-address=151.167.8.12 dst-port=2022 protocol=tcp to-addresses=192.168.88.3 to-ports=22
The SSH client times out with this output:
OpenSSH_7.6p1 Ubuntu-4ubuntu0.4, OpenSSL 1.0.2n 7 Dec 2017
debug1: Reading configuration data /home/vds/.ssh/config
debug1: /home/vds/.ssh/config line 27: Applying options for 151.167.8.12
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 151.167.8.12 [151.167.8.12] port 2022.
debug1: connect to address 151.167.8.12 port 2022: Connection timed out
ssh: connect to host 151.167.8.12 port 2022: Connection timed out
post your config
/export hide-sensitive file=anynameyouwish
I am assuming you mean you are coming in from an external WAN connection (like coffee shop etc.) and wish to connect to your LAN through the public IP address of your Router??
a quick look dont see why its not working assuming you have indicated your public IP (hopefully just an example and not the actual)??
Also this has nothing to do with the SSH settings on the router right?
@vds, I’d like to draw your attention to what @anav already asked: are you actually trying to connect from WAN side of your router? Because your current config won’t do for connecting to public address from LAN side of your router.
@anav So, I was testing it wrong and it was already working from the outside, thank you and @mkx for pointing it out.
Anyway, with your last rule, it works also from inside the LAN, which is what I also wanted, shall I keep the rule or it’s not a good idea?
I just pass on the information I learned here, if you want to thank somebody thank MKX, who pointed it out to me long ago.
To be truly helpful I would explain why this works, if I could.
It has something to do with
a. router takes shortcuts sometimes in certain cases where the ip address is local on the router and can bypass connection tracking.
b. so when the the router sees the packets coming back from the server responding to the request, instead of sending it through NAT and back to the original destination IP it sees the answer coming back from the same subnet as the request and simply routes the return packet directly to the originator (however, the originator machine is expecting the packet back from the WANIP and rejects the packet coming from the local server IP).
c. so one can either change the subnet the server is on, and for this the router respects the NAT process OR as per the rule that MKX providing,
in this case the source IP from the originator is also changed, what happens after is a mystery to me but it works… as I dont see how the source nat will help, as I get lost in what the router will see on the reply and how it handles the reverse action of the extra source nat rule, and yet ignores the dilemma of what caused the problem in the first place