Sorry for the stupid question but how do I set up port forwarding for an SSH server? reddit / selfhosted ---------------------------------------------------------------------- Waeningrobert · 2023-10-17 16:01 I feel that I’ve done everything right. I’ve created a section in the port forwarding section that forwards all incoming port 22-29 connections to port 22 and my servers ip. When I try to connect from an outside network as USERNAME@MY PUBLIC IP it just times out. ---------------------------------------------------------------------- nitsky416 · 2023-10-17 16:16 Don't. Don't expose SSH to the internet. ---------------------------------------------------------------------- poeticmichael · 2023-10-17 16:26 Install Tailscale on the target PC or server, then enable ssh on your account at Tailscale website. Install Tailscale on the device you intend to use for accessing other devices. That’s it. You can now login to the device(s) via ssh. ---------------------------------------------------------------------- Cylian91460 · 2023-10-17 16:34 Wait ISP block port like that ? I never saw this happen. ---------------------------------------------------------------------- nitsky416 · 2023-10-17 16:38 All the time. I don't think you understand how serious a security risk what you're doing actually is. ---------------------------------------------------------------------- Cylian91460 · 2023-10-17 16:43 Oh yeah I know it's a security risk and I only do that on servers that I have physical access + doesn't use password only key ---------------------------------------------------------------------- HoustonBOFH · 2023-10-17 16:51 Why 22-29? And make sure the source port is any... More specific instructions are based on your firewall. Also, the usual warning about how this is a bad idea, and you will be brute forced constantly. ---------------------------------------------------------------------- m_vc · 2023-10-17 17:03 One can route all traffic (like a vpn) through an ssh-tunnel. ---------------------------------------------------------------------- Waeningrobert · 2023-10-17 17:05 Doesn’t work in Russia :( https://reddit.com/r/Tailscale/s/wI71iSDDwS Any other ideas? ---------------------------------------------------------------------- AdrianTeri · 2023-10-17 17:08 Some institutions of higher learning too... ---------------------------------------------------------------------- Ninfyr · 2023-10-17 17:55 ISPs are try to protect users from themselves. The vast majority of users have no clue what they are doing. Usually giving them a call can persuade them to charge it for you, or they might push you into getting a commercial/business Internet service. ---------------------------------------------------------------------- phein4242 · 2023-10-17 18:28 If you want to forward an ssh connection over an existing ssh connection, ProxyJump is the way to go. ---------------------------------------------------------------------- WubbaKnight · 2023-10-17 19:36 Genuine question.. What exactly are the risks involved with this? Assuming OP takes the most basic steps to harden SSH (disable root login, disable password auth, enforce key auth only) - SSH should be just as secure as, say, WireGuard since both use public key as auth? ---------------------------------------------------------------------- zoredache · 2023-10-17 23:28 I think they are asking how to configure Port forwarding on their border router/firewall for incoming SSH connections from elsewhere on the Internet. Not how to transport other protocols over a working SSH connection. ---------------------------------------------------------------------- mosaic_hops · 2023-10-18 01:24 How is ssh a security risk if you’re not doing something absolutely daft with it? Yeah you’ll get logspam but you have the same logspam issue with a VPN and can be daft with a VPN too. ---------------------------------------------------------------------- Over-Advice6046 · 2023-10-18 03:39 Before you porr forward your ssh, you need to secure it first, example: 1. Changing your ssh port to unusal port (something above 20000 or 30000 would be good) 2. Setup your ssh to not use password auth and use only pubkey After you set that, port forward the port that you choose and run the command in your terminal or powershell: ssh -v 'pubkeynameyouchoose.pub' -p 'portyouchoose' username@ipaddress ---------------------------------------------------------------------- Over-Advice6046 · 2023-10-18 03:40 Oh and make sure your net didnt sit behind CGNAT. ---------------------------------------------------------------------- krinkuto11 · 2023-10-18 10:47 What about only accepting SSH Keys and disabling password login? Could that make exposing it acceptable? ---------------------------------------------------------------------- phein4242 · 2023-10-18 10:49 Hard to say without proper info