Establishing an SSH connection between two machines separated by two routers requires configuring port forwarding on both devices and ensuring proper NAT traversal. By mapping external ports to internal IP addresses at each router level, you can create a secure tunnel that bypasses intermediate network barriers. This guide details the specific steps to configure your home network for reliable remote access.
Understanding the Network Topology
Before modifying any settings, it is crucial to visualize how data travels through your infrastructure. In a typical double-NAT scenario, you have an Internet Service Provider (ISP) modem or primary router, followed by a secondary home router, which then connects to your target machine. The primary challenge here is that the secondary router hides the target machine from the outside world, and the primary router further obscures the entire home network. To bridge this gap, you must treat each router as a distinct gateway that needs explicit instructions on where to send incoming traffic. The goal is to create a chain of redirections: traffic arrives at the public IP of the primary router, gets forwarded to the secondary router’s IP, and finally reaches the specific local IP of your SSH server. Without this layered configuration, packets will be dropped because neither device knows how to handle the incoming request destined for a private address space.Identifying Your Local Addresses
Start by identifying the static local IP addresses of all relevant devices. You should assign static IPs via DHCP reservation on both routers to prevent address changes that would break your configuration. For the target machine running the SSH service, note its local IP (e.g., 192.168.1.50). For the secondary router, note its LAN IP address (e.g., 192.168.1.1). Finally, identify the public IP address assigned to your primary router by the ISP. If your ISP uses Carrier-Grade NAT (CGNAT), standard port forwarding will not work, and you may need to contact your provider or use a tunneling service instead.Configuring the Secondary Router
The first step in the chain is to configure the router closest to your target machine. Log into the administrative interface of the secondary router. Navigate to the Port Forwarding or Virtual Server section, which is often found under Advanced Settings or NAT rules. Create a new rule that maps an external port on this router to the internal IP of your SSH server. Most SSH servers listen on port 22, but it is highly recommended to change the internal listening port to something non-standard, such as 2222, to reduce automated scanning attacks. Configure the rule to forward incoming traffic on port 2222 (or your chosen port) to the local IP of the SSH machine on port 22. Save the settings and verify that the rule is active. This step ensures that any traffic directed to the secondary router’s WAN interface is correctly routed to your computer.Configuring the Primary Router
Next, log into the primary router connected directly to your ISP modem. Locate the Port Forwarding section again. Here, you must forward traffic to the secondary router rather than the final machine. Create a new rule that forwards the same external port you used in the previous step (e.g., 2222) to the local IP address of the secondary router (e.g., 192.168.1.1) on the same port. This creates the necessary link between the public internet and your inner network. When a connection attempt arrives at your public IP on port 2222, the primary router passes it to the secondary router, which then passes it to your SSH machine. Ensure that no other conflicting rules exist that might intercept this traffic. Some modern routers offer "DMZ" host features; while these can simplify setup by exposing all ports, they significantly reduce security and are not recommended for SSH access unless absolutely necessary.Testing and Troubleshooting Connectivity
Once both routers are configured, test the connection from an external network, such as using mobile data with Wi-Fi turned off. Open a terminal and runssh -p 2222 user@your_public_ip. If the connection times out, several factors could be responsible. First, check if your ISP blocks common ports. Many residential providers block inbound traffic on ports 22, 80, and 443. If this is the case, ensure you are using a high-numbered port like 2222 or 49152.
If the connection still fails, verify that firewalls on the target machine are allowing inbound traffic on the SSH port. On Linux systems, check ufw status or iptables rules. On Windows, ensure the Windows Defender Firewall allows SSH connections. Additionally, some ISPs implement strict firewall policies that drop ICMP or specific TCP flags, which can interfere with initial handshake attempts. If you suspect this, try connecting using different protocols or tools to isolate the issue.
For more complex scenarios involving dynamic DNS or failed connections, reviewing related troubleshooting guides can provide additional context. You might find useful insights in Connection to host xxxxxxxxxx at port 22 connection timed out, which addresses common timeout errors during SSH initialization.