I recently set up SSH on my newly installed ubuntu, and already set up public key authentication and know that it works properly remotely on my local network. Now I decided that I would make it available to myself outside my LAN, so I'm wondering whether to use the router port-forward way or the no-ip/dynamic dns way.(if the server isn't already online automatically)

Which one is more preferred, from a security standpoint and in general? (Or is it already made available online from when I originally installed it?)



These are basically two different things, both of which you may want to use to some capacity. Port forwarding allows you to open up a port (in this case port 22) on your outside facing router to allow traffic to a certain computer on your subnet (the computer you want to SSH into). This essentially opens up your computer to the outside world so you can log into it from outside your local intranet.

The dynDNS portion is what would allow you to point a domain name (EX www.mycomputer.com) to the IP address that your ISP assigned to you. The reason this is so helpful is that most residential ISPs will use a non-static IP address (meaning that it changes every so often) and this would require you to keep track of the IP as it changes> dynDNS allows you to use the domain name and have it automagically resolve to whatever IP you have at the time.

So in short; you will most likely want to use both in order to SSH into your machine from outside your local intranet.

As far as security is concerned you should be ok on a properly patched/configured system. Of course there is always the potential for attack when you open a computer to the internet but it is regularly done without much problem. The only thing you are likely to see is scripts attempting to break your password but that is why you use public keys to authenticate ;)

  • thanks for the help! However, can I ask something else? I set everything up, with a no-ip and installed the software on my ubuntu. Earlier I had also port forwarded my router from port 22 to 22. However, I still cannot connect from the outside, as my connection keeps getting refused. I heard it may be comcast blocking my connection. Are they? My comcast modem seems to have a router built in.Modem is a cable modem, firewall set to medium security on the router(I turned it off to see if that would still not work, and even with the firewall off it still wouldn't work.) My router has a dynamic ip – senorchungbob Oct 23 '13 at 1:37
  • I can currently only ssh into my machine locally, but not externally. I think this may be a network issue with my modem/router maybe...?! – senorchungbob Oct 23 '13 at 1:42
  • Your provider is probably blocking port 22, try another port above 1024 that is not used en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers. You might also want to configure fail2ban or knockd (see askubuntu.com/questions/32246/…) – LiveWireBT Oct 23 '13 at 8:59
  • triedswitching the ports for ssh and forwarding all to 1500......also tried switching the entire router firewall off.....Is Comcast blocking the request, or is my WAN IP not the right type(it's 24.5.xxx.xx - is that supposed to be a valid address?) – senorchungbob Oct 24 '13 at 0:45
  • Where are you making the port forwarding configurations? On the Comcast router? I have Comcast and - at least for me - I have not seen them block port 22. It is very unlikely that they are doing that. – Atari911 Oct 26 '13 at 17:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.