Or is that what the port-forwarding is about--80->22?

---
Now accepting suggestions for a new sigline

static IPs on the internal network. It's been a while since I did port-forwarding on the home router, but I thought one had (?) should (?) use static IPs for it. Or maybe just pick static IPs for the one or two machines that you need access to, and let the others be DHCP, since I think you can specify the DHCP range, and can then exclude the static IPs from that range.

and i can ssh in to home just fine, except for having to change the forwarding whenever my server gets a new ip lease and change the dns whenever rogers decides to change my ip.

here's an easy test for whether or not you have the forwarding set up properly:

from the box that you are forwarding ssh to, type "ssh 192.168.1.1" and see if you get a loopback.
---
_{I don't think anyone's ever really died from smoking. --ni}

Exclude a range of IPs from the dhcp.
Give static addresses to at least the sshable machine from the excluded range.
22 is indeed the ssh port.
Check that you are forwarding tcp/22 to the static IP.
Check that the router's firewall is not blocking forwarded trafic on port 22 ;-)

Can't help you with the BEFW11S4 though.

All of the machines in the internal network use static (intranet) IPs, not DHCP. I also have a static (internet) IP from my ISP.

I have NAT forwarding set up to ssh on a couple of different machines, and a web server. All of them are on non standard port numbers. So it's something like this (fictional example):

if my static IP is 1.2.3.4 and the home network is on 192.168.0.*

1002 1.2.3.4 --> 22 192.168.0.1 (ssh to web server)
1003 1.2.3.4 --> 80 192.168.0.1 (web server serving web)
1004 1.2.3.4 --> 22 192.168.0.2 (ssh on other box)

I realise I could just have one ssh open and go through it to get to the other machine, but I'm a bit too lazy for that.
---
(,   ,') -- eep
"This option is deprecated, as it is conceptually flawed." -- man psql

Give out static IP addresses for your internal boxen, or at least the ones that you want to ssh to from outside. IIRC, you should be able to mix and match by setting the DHCP server in the router to start a high number which effectively reserves the lower numbers for static use.

You may also have to set up port forwarding on your DSL `modem' before it will allow connections from outside to come in. Most of those things are really routers that do NAT and reject connections not initiated by something on the inside of the network.

---

There is no more degenerate kind of state than that in which the richest are supposed to be the best.
Cicero, The Republic

Your set-up is not so disimilar to ours.

Statically assign the IP of the webserver. This can be done at the router, usually under "static routes" or somesuch in its config, then port-forward port 22 to this address. You then have to change the router's DHCP assignment so that it starts assigning IP addresses outside a range which doesn't include the webserver.

On our network, 192.168.0.1 is the router, .0.2 and .0.3 go to static machines which are hardwired-in, .0.4 goes to the webserver and the router is set to use .0.8 and above for DHCP requests.

It's adviable to use a non-standard port for the SSH daemon - we run it up on 34543 or somesuch. This cuts down an incredible number of attempted SSH hacks as port 22 just isn't open and they just bounce. Otherwise, your /var/log/messages will get full of taiwanese kids trying all the default accounts, like 'apache', 'root', 'guest' etc. which modern unixs helpfully configure in advance. You can specify the port ssh uses to connect at the client.

Doing this means that the domain names, as opposed to IP numbers won't necessarily match from inside and outside the network. There are a few solutions to this. 1.) Hack the hosts file on the router (if it has one) to route named requests accordingly; 2.) Hack the hosts files on the individual computers; 3.) Run BIND or somesuch inside the network. For a network of that size, running DNS/BIND isn't really worth it, so do 1 or 2. Remember, you only need to do this for internal machines which need to use hostnames. You can still happily use network-specific IPs without bothering.

----
17 days left ...

Your linksys dhcpd might support reserving IPs to specific MAC addresses.

(My home network has a file server, so I run my own dhcpd)

1. As others have said, you should probably: a) Give the machine you want to access a static IP address. (You can probably just pick one a few higher up than the router is likely to assign and it'll work) b) If your router allows it, specify this machine at the DMZ. This is the easiest (although slightly less secure) way to do these things.
2. You have some kickass machine names. I may steal "fray" for my own nefarious purposes.

my experience is that people will do amazingly stupid things in conjunction with their crotches -- persimmon

based on what you describe I think your best bet will be to set your webserver/ssh box, with fray as the second choice if you think that will stay powered on more often.

As others have said, you want to do static dns instead of of DMZ, which should be pretty easy to configure.  if you need some help with this on the weekend, let me know and I'll try to step you through it and help.

____________________________________
You sir, are worse than Hitler.

OK, so I mucked around with stuff last night. I gave fray a static IP addy on the internal net, and that seems to work.

I pinged dyndns.net with our (then-current) IP addy from the DHCP server at verizon. It's still serving the one from before that. How long does it take to get a new IP addy through the system?

I verified that I could ssh into fray from the work machines, using the correct IP addy. So, yay!

Oddly, I couldn't ssh directly from my laptop to fray using the outside-universe IP addy. Perhaps the fact that they're both using that addy confuses things or something. I don't really need to be able to do this, because I can ssh around the internal network using internal IP addys.

I installed DarwinPorts and then irssi on fray, and verified that it all works (albeit with some significant delays that might be due to the fact that the terminal windows were logged in from here to there and back multiple times).

Today, though, things timeout. Turns out our old friend the balky wireless router and/or DSL modem is at fault. From time to time it needs rebooting, and (of course) verizon's DSL gives me a different IP addy when that happens, so I was trying the wrong IP addy. Must fix this.

So I can see this thing working, if I can find out what IP addy the home machines have at a given time. If dyndns doesn't propagate fast enough, is there another solution? I could set up a cron job at home to e-mail me the addy or ssh in or something twice a day, I suppose...

Oh, and thanks to mns for letting me use his network all this time. What with the moving thing coming up, that's apparently shut down for a month or two.

Can you introspect out loud? --CRwM