An extranet PC (Win7 system) explores ways to connect to other LAN PCs (Linux systems) via SSH

To facilitate the narrative, the extranet PC (Win7 system) referred to as host W, the PC (Linux system) referred to as host L.

A basic network environment of two hosts is described below.

A. Host L is a home PC that connects to the network operator's gateway via a router to connect to the Internet. Routers without fixed external network IP, router extranet IP changes, you need to change the IP address of the remote connection destination at the host W.

B. Host W is connected to the corporate LAN and can be connected to the Internet via the corporate gateway.

The following is a description of the implementation process.

1. Configuring the Host L

(1) Access the Router Network Settings Management page via the browser. I use the router model is Iptime n604a, in the browser address bar input 192.168.1.1 and enter, click on the page "Administrative Tools" to enter the network Management page. In the intranet network information to find the scope of the intranet can use IP.

(2) Fixed host L's intranet address. In the shell terminal input

Vi/etc/sysconfig/network-scripts/ifcfg-eth0

Command (Note 1: root permission required; Note 2: If you use eth1 or other channels to surf the Internet, you should replace Ifcfg-eth0 with ifcfg-eth1 or other appropriate files), after opening the file, add a line

ipaddr=192.168.1.x

and save (note 3:x must be included in the IP range of the path viewed in step (1)).

(3) Confirm that the host L is installed and running the SSH service. This step is simple, you can refer to the network.

(4) For security reasons, before you open the SSH connection of host L to the Internet, you should modify the SSH default connection port or restrict the reachable IP. (This article discusses only the former, changing to Port 2028, which is more secure and can refer to the network)

(4-1) in the shell terminal input

Vi/etc/sysconfig/iptables

(requires root permission), after opening the file, add new port 2028 to the firewall, and the Red Font section is the new content.

# Firewall configuration written by System-config-firewall
# Manual Customization of this file are not recommended.
*filter
: INPUT ACCEPT [0:0]
: FORWARD ACCEPT [0:0]
: OUTPUT ACCEPT [0:0]
-A input-m state--state established,related-j ACCEPT
-A input-p icmp-j ACCEPT
-A input-i lo-j ACCEPT
-A input-m state--state new-m tcp-p TCP--dport 22-j ACCEPT
-A input-m State--state new-m tcp-p TCP--dport 2028-j ACCEPT
-A input-j REJECT--reject-with icmp-host-prohibited
-A forward-j REJECT--reject-with icmp-host-prohibited
COMMIT

After you save the file and exit the edit, restart the firewall to make the configuration effective and enter and execute it in the shell terminal

/etc/init.d/iptables restart

Service Iptables Restart

Command (requires root permission).

(4-2) Change the SSH connection port.

It is best to back up the source files before changing. Enter and execute the shell terminal in turn

Cp/etc/ssh/ssh_config/etc/ssh/ssh_configbak

Cp/etc/ssh/sshd_config/etc/ssh/sshd_configbak

Command. Then modify the SSH port to 2028. In the shell terminal input

Vi/etc/ssh/sshd_config

Open the configuration file, and then save the exit after you add a line to Port 2028 below the #Port 22 line. In the shell terminal input

Vi/etc/ssh/ssh_config

Open the configuration file, and then save the exit after you add a line to Port 2028 below the #Port 22 line.

Restart the SSH service for the changes to take effect, enter and execute in the shell terminal in turn

/etc/init.d/sshd restart
Service sshd Restart

Command (requires root permission).

(5) Go back to the page opened by step (1), open the NAT administration page in the advanced settings, and add the IP and port mapping rules for host L.

The internal IP is set to the fixed intranet IP in step (2).

The external port is set to 6050-6050 (it can also be set to a different port number and will be connected remotely via this port number on the host W in the future.)

The internal port is set to 2028-2028 (that is, the port number set in step (4))

The transport protocol is selected as TCP.

(6) Locate the external IP address of the router on the page opened in step (1).

At this point the host L-side configuration is complete, but the security is low, please refer to the method on the network, increase access security.

2. Host W remote connection

Use the SSH connection to the client such as Xshell and putty to establish an SSH connection, the host address is 1-(6) The resulting IP address, the port number is 1-(5) Set the external port number, then you can connect the road host L. It's that simple.

Reprint please indicate the source and author, thank you.