To configure an SSH router connection with main company WiFi using the TP-Link Archer A23, you must first establish a stable network link between your Linux client and the Archer A23 via Ethernet or local WiFi. Since the Archer A23 does not support native SSH server functionality, you cannot log directly into the router's interface via SSH. Instead, you use the Archer A23 as a bridge to reach a separate Linux host that has SSH enabled, ensuring secure remote access through proper port forwarding or tunneling configurations.
Understanding the Network Topology
The core misunderstanding in many setups is assuming that consumer-grade routers like the Archer A23 can act as SSH servers. They cannot. The Archer A23 functions strictly as a Layer 2/Layer 3 switch and wireless access point. To achieve SSH connectivity, you need a target device (such as a Raspberry Pi, a dedicated Linux server, or even a PC running a Linux distribution) connected to the same network segment as the Archer A23.
Your goal is to connect from your primary workstation to this target device. The Archer A23 provides the physical and wireless infrastructure for this connection. If your company WiFi is separate, you may need to connect the Archer A23’s WAN port to the company network or use it in Access Point mode if supported by your specific ISP setup. However, for most internal lab or office scenarios, connecting the Archer A23 to your existing network allows devices on its LAN to communicate freely.
Verifying Network Connectivity
Before attempting any SSH commands, ensure your Linux client can see the target device. Connect your Linux machine to the Archer A23 via an Ethernet cable plugged into one of its LAN ports, or connect to its default WiFi SSID. Open a terminal and ping the IP address of your target Linux host. If the ping fails, check your network adapter settings and ensure both devices are on the same subnet, typically 192.168.0.x for the Archer A23 default configuration.
If you are unable to reach devices across different subnets, refer to Reach Network Devices Via WiFi or Ethernet for detailed troubleshooting on bridging connections between wired and wireless interfaces.
Configuring the Target Linux Host
Since the Archer A23 cannot handle SSH, all SSH configuration happens on the destination Linux machine. Ensure the SSH service is installed and active. On Debian-based systems, use sudo apt install openssh-server. Verify the service status with systemctl status ssh. It should be active and running.
Next, determine the static IP address of this target host. While DHCP usually assigns addresses automatically, it is best practice to assign a static IP or a DHCP reservation in your router’s admin panel to prevent IP changes that break your SSH shortcuts. Log into the Archer A23 web interface at http://192.168.0.1 using the default credentials (usually admin/admin unless changed). Navigate to the DHCP Server section under the Advanced tab. Find the MAC address of your target Linux host and reserve a static IP for it.
Establishing the SSH Connection
With the network layer confirmed and the SSH service running on the target, initiate the connection from your Linux client. Use the standard SSH command format:
ssh username@target_ip_addressReplace username with the actual user account on the target machine and target_ip_address with the reserved IP you configured earlier. You will be prompted for the password. If this is your first time connecting, you will see a fingerprint verification message. Type yes to add the host to your known hosts file.
If the connection times out or hangs, it is likely a firewall issue. Check the UFW (Uncomplicated Firewall) on the target Linux machine with sudo ufw status. Ensure that port 22 is allowed. For example, run sudo ufw allow 22/tcp. For more complex timeout issues involving ethernet vs WiFi transitions, consult Troubleshooting SSH Timeout Issues with Ethernet Connection.
Securing the Connection
Using passwords for SSH is convenient but less secure than key-based authentication. Generate an SSH key pair on your client machine using ssh-keygen -t ed25519. Then, copy the public key to the target host using ssh-copy-id username@target_ip_address. This allows you to log in without entering a password every time, significantly speeding up workflow.
Additionally, consider disabling password authentication entirely on the target server by editing /etc/ssh/sshd_config and setting PasswordAuthentication no. Restart the SSH service with sudo systemctl restart ssh. This ensures that only users with valid keys can access the system, protecting against brute-force attacks.
Handling NAT and Port Forwarding
If you need to access this SSH server from outside your local network (e.g., from another office or home), you must configure port forwarding on the Archer A23. In the web interface, go to Forwarding > Virtual Servers. Add a new rule mapping an external port (e.g., 2222) to the internal IP of your Linux host on port 22. Note that many ISPs block inbound traffic on standard ports, so using a non-standard external port is often necessary.
Be aware that if you are traversing multiple networks, such as a corporate WiFi gateway before reaching the Archer A23, you might encounter additional routing layers. Understanding whether packets are being forwarded locally or routed externally helps diagnose these barriers. See Understanding Packet Forwarding vs Local Delivery in Network Routing for deeper insights into how your router handles these packets.
Troubleshooting Common Issues
If you still cannot connect, verify that the Archer A23’s AP Isolation feature is disabled. This feature, sometimes found in WiFi settings, prevents devices connected to the same WiFi network from communicating with each other. It must be turned off for your Linux client to talk to the target SSH server.
Another common pitfall is incorrect subnet masks. Ensure both your client and the target have a subnet mask of 255.255.255.0 (/24). Mismatched masks can cause routing failures even if IPs look similar. Finally, check if any intermediate firewalls, such as those provided by your company’s WiFi controller, are blocking outbound SSH traffic. If SSH is mysteriously blocked despite correct local settings, review Troubleshooting SSH Connection Issues for advanced diagnostic steps.
Frequently Asked Questions
Can I enable SSH directly on the Archer A23?
No, the TP-Link Archer A23 does not support running an SSH server daemon. It is a consumer-grade router designed for web-based management only. You must use a separate Linux device connected to the router for SSH access.
Why can't my Linux client ping the target device?
This is often due to AP Isolation being enabled on the Archer A23’s WiFi settings, which isolates wireless clients from each other. Disable this feature in the Wireless Advanced settings, or ensure both devices are connected via Ethernet cables to the LAN ports.
Is it safe to forward port 22 from the internet?
It is generally unsafe to expose standard SSH port 22 directly to the internet due to high volumes of automated brute-force attacks. It is recommended to change the external port to a non-standard number (like 2222) and use key-based authentication exclusively.
How do I find the IP address of my target Linux device?
You can find the IP address by logging into the Archer A23 web interface at 192.168.0.1, navigating to the DHCP Client List, and locating the hostname or MAC address of your target device. Alternatively, run ip addr show on the target device itself.
What if I get a "Connection Refused" error?
A "Connection Refused" error means the network path is clear, but no service is listening on the specified port. Ensure the SSH service is actually running on the target Linux machine using systemctl status ssh and that no local firewall is blocking port 22.