I have an Ubuntu firewall box (Alma), at the office, with a web server on it. It looks like this:

[Internet] <-> [DSL Router] <-> [Alma]
                  [DMZ:10.1...] <--+--> [Internal LAN:192...]

Whenever I am at home, outside of Alma, I can get to it just fine through SSH. When I am inside, on the internal LAN I cannot use the public IP address to log in to the box, but instead must use the local subnet 192... Alma has 3 NIC interfaces.

I'd like to be able to script some things using a single public IP address. Let's say it is This problem prevents doing that easily. Is there a way to make this command:


work from inside on the 192 subnet as well as the internet? The odd thing is that I can ping from inside or outside just fine. But when I try to SSH to from inside, the connection is refused.

What am I doing wrong, or not doing correctly?

My SSH daemon listens on The firewall logs no attempt at all when I try from inside.

Any help is appreciated.

  • 1
    Is your firewall blocking outgoing SSH traffic?
    – Kevin
    Jan 25 '12 at 15:59
  • I have to ask is there any reason why you are even allowing SSH traffic into your firewall from outside? And secondly is there any reason why you just won't alias a hostname to external address when you are home and internal address when you are at work?
    – Karlson
    Jan 25 '12 at 16:04
  • 1
    Sounds like a NAT Loopback issue , whats the model of your router?
    – squareborg
    Jan 25 '12 at 16:09
  • Kevin, my firewall is not blocking ssh traffic. I can ssh to any open host on the net.
    – Midwire
    Jan 26 '12 at 15:50
  • Karlson, I allow ssh traffic into my firewall because I want to be able to administer/make changes to stuff at the office from home. Aliasing a hostname can be done but that means whenever I move between office and home I have to edit the hosts file. I can do that but I'd rather not. I should be able to access a given IP address the same way, whether I'm inside or outside the LAN.
    – Midwire
    Jan 26 '12 at 15:53

Another approach would bo set up a local dns server and use names instead of ip addresses. The concept is called Split horizon DNS. your-machine.yourdomain.com would resolve to locally, and when used externally.

See also: Split horizon

And I personally would recommend to use djbdns (or a fork of it) and not bind.

  • reto, I'm familiar with Split Horizon DNS. I'd rather solve the real issue instead of trying to work around it. It just seems to me that I should be able to do this without a workaround.
    – Midwire
    Jan 26 '12 at 15:56
  • NAT is ugly.. it should have never been invented.
    – reto
    Jan 26 '12 at 16:08
  • I cannot disagree with that. It does seem like its trying to do double NAT. NAT out to public IP, NAT in to firewall.
    – Midwire
    Jan 26 '12 at 17:15

You have to configure Alma to do destination NATing for the public IP address when accessed from internal LANs.

Say is the public address and the local IP. Then put these lines on iptables config:

-A PREROUTING -d -s -j DNAT --to-destination

any packet for from local LAN will be rerouted (with destination NATing) to

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.