Port Forwarding an SSH Connection on macOS

Question

I have been trying to use SSH over the internet to connect to a few different computer on my network. Unfortunately, it only seems to work on the computer that is set to the forwarded port of 22 (ssh port). Here is what I have done:

Router: Port forward 70 -> computer IP address

macOS Terminal:

ssh -L 22(ssh port) : my_external_ip : 70(forwarded port) username@my_external_ip

It connects and then asks me for the password for the account "username". Even though I type in the correct password, it gives me "Permission denied (publicly, password)

I have been trying this all day and cannot figure it out. I can access my router non-locally and change the computer I am trying to access to forward to port 22, but I would really like a better solution.

I am not very familiar with bash commands (I think these are bash?) and am at a loss. Fortunately I have been able to connect to my storage server via SAMBA, but I would really like to be able to ssh into each computer independently.

Answer 1

If I understand the setup properly, you're using the wrong option to control what port it makes the connection over. If the router is forwarding port 70 to port 22 of the internal ssh server you want to connect to, then from the outside you'd connect with something like:

ssh -p 70 username@router_external_ip

Note that I'm using -p 70 to control what port it connects to on the "server" (which is actually the router, but since the connection comes in on port 70 it should be forwarded to port 22 on the internal server).

This is very different from what the -L option does. What -L does is tell ssh to make a (tunneled) port forward of its own after connecting to the SSH server. Adding -L 22:someip:70 tells the ssh program to listen on port 22 of your local computer (by default, it also listens only in the local loopback interface), and if it receives any connections on that port it should forward them over the SSH connection to the remote computer, with instructions that the remote computer should forward them on to port 70 on someip.

You could use sort of port forward, for example, to tunnel filesharing connections to your storage server so you wouldn't have to have to expose the storage server directly on the open Internet (which is probably not very safe). There's an example of using it to tunnel VNC (screen sharing) in this stackoverflow question.

Answer 2

Create multiple forwarding rules in the router, one for each machine behind it that you want to SSH into. Use different high ports as the input for each.