I have two computers behind the same router. Let's call them A and B.

A can SSH to B in the following manner: ssh usr@<internal ip of computer>

B can SSH to A by doing the same, but the external IP must be used. I have forwarded port 22 of my router to the IP of computer A, so that all makes sense to me.

However, I want to also forward port 26 to computer B, and SSH from outside the network by using the external IP for both, but specifying either port 22 or 26, to effectively select which computer to use.

I have tried allowing port 26 through OUTPUT of iptables on A and INPUT of B, but that didn't seem to work. I have also forwarded port 26 to the internal IP of B (through the router), as I did with 22 for A.

Here's what I get when I try to SSH from A to B using the external IP and port 26:

ssh: connect to host xx.xx.xxx.xx port 26: Connection refused.


  • A = OpenSSH_5.9p1 Debian-5ubuntu1, OpenSSL 1.0.1 14 Mar 2012
  • B = OpenSSH_6.0p1 Debian-4, OpenSSL 1.0.1c 10 May 2012

A has 12.04 Ubuntu, B is a Raspberry Pi with Raspbian.

EDIT: Something that I forgot to put in: I did try switching the SSH config file (I found it is /etc/ssh/ssh_config) I uncommented (deleted the #) the line with Port and changed 22 to 26. It gave me the connection refused message still. (I rebooted to no avail.)

  • Do yuu ohave SSH running on port 22 or 26 on the second machine? – Nerdfest Mar 4 '13 at 22:49
  • Note that /etc/ssh/ssh_config is the ssh client config. Where as /etc/ssh/sshd_config is the ssh daemon config. – steakunderscore May 2 '13 at 1:23

It seems like you're not running SSH on port 26 on the second machine. You can either change the port number on that machine to 26.

Either edit /etc/ssh/sshd_config & don't forget to restart SSH or leave it on 22, but forward port 26 on the router to port 22 on the second machine. Also, don't forget to change any firewall settings on the second machine to allow the connections through.

  • Ahhh...so sshd_config must change, not ssh_config? – Gary Mar 4 '13 at 23:26
  • 2
    Correct. sshd is the service (d is for daemon). Edit the config file (with sudo gedit), then restart the service with "sudo service ssh restart". – Nerdfest Mar 5 '13 at 5:11
  • 2
    Solved the problem. Didn't have to change any firewall settings either. – Gary Mar 5 '13 at 13:28

If you are on Linux system and you want connect to an SSH server on port 26 you can use the following command.

ssh user@ -p 26


  1. Replace server IP with the IP Address or DNS name of your server.
  2. Change your port number as you have set.
  3. if you are using custom port SSH then same port most be allowed for outbound, inbound connection on firewall otherwise the connection will not establish
  • 9
    This one should be marked as correct. – ken_oy Jun 6 '17 at 18:33
  • 1
    I agree this is the correct answer. This one is simple and goes to the point. – m4l490n Jan 20 '18 at 18:12
  • 1
    @gary mark this one as correct – sorrow poetry Apr 8 '18 at 5:05
  • 4
    No this is NOT the correct answer. OP had trouble with daemon not listening on desired port. He clearly asked for help with SSH server and/or NAT configuration, but current answer ignores original post and describes client command option already known to OP. I wonder how this answer got so many upvotes. – nnovich-OK May 4 '18 at 7:29
  • 1
    @Gary This answer is the correct one. Accept this answer as the right Answer. – Dheeraj M Pai Aug 8 '18 at 5:45

I use port 22 only for the intranet ssh access.

For access via internet I use a custom (unusual) port. This has the benefit the I reduce the load produced generated by script kids who are scanning port 22 for "well known usernames"

The external sshd processes are controlled by xinetd and running in parallel to the internal sshd process. In the following example I use the port 12345. You are free to change this to any available free port number on your system. Maybe a higher value will make it also a bit more unlikely that this port is scanned by a "quick port scan".

The xinetd configuration is:

service ssh-external
    socket_type = stream
    wait = no
    protocol = tcp
    type = UNLISTED
    user = root
    server = /usr/sbin/sshd
    server_args = -i -f  /etc/ssh/external-sshd.config
    port = 12345
    log_on_failure += USERID


The file /etc/ssh/external-ssdh.config can be a copy of your usual sshd configuration. Ensure that the following statements are configured:

Port 12345
AddressFamily inet

I also suggest to enforce public key authentication and disable password authentication for the internet access:

PasswordAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no

Listen ports also can be hard linked to IP addresses


  • this should be a comment not an answer. – Pablo Pazos Oct 23 '18 at 1:10

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.