SSH Port Forwarding:Quickstart

What Changed?

The SSH port forwarding system has been refactored from hardcoded iptables rules to a flexible, configuration-driven system. This makes it easy to add SSH access to multiple devices on your VPN.

Before

Hardcoded iptables rules in /etc/iptables/rules.v4

Manual rule management

Difficult to add new devices

After

Configuration file: /etc/ssh-port-forwards.conf

Management script: ssh-forward (or ssh-port-forward-manager.sh)

Easy to add/remove devices

Automatic rule application

Your Existing Setup

Your Synology NAS SSH forward has been migrated automatically:

Device: synology

External Port: 22222

VPN IP: 10.8.0.2

SSH Port: 22

Access: ssh -p 22222 user@87.106.61.62

No changes needed - everything continues to work as before!

Adding a New Device

Example: Add a Raspberry Pi

Verify the device is on VPN:

=== Check if device is connected ===
   cat /etc/openvpn/server/ipp.txt
   ping -c 2 10.8.0.3  # Replace with your device's VPN IP

Add the port forward:

   sudo ssh-forward add raspberrypi 22223 10.8.0.3 22

Verify it's active:

   sudo ssh-forward list

Test from external location:

   ssh -p 22223 user@87.106.61.62

Configure IONOS firewall:

  * Log in to https://dcd.ionos.com/

  * Navigate to: Server & Cloud → Servers → [Your VPS] → Firewall

  * Add rule: TCP port 22223 → Allow

Common Commands

=== List all SSH port forwards ===
sudo ssh-forward list

== Add a new device ==
sudo ssh-forward add <name> <external_port> <vpn_ip> [ssh_port] # Remove a device
sudo ssh-forward remove <name>

== Reapply all forwards (after manual config edit) ==
sudo ssh-forward apply

Port Recommendations

22222-22299: Reserved for SSH port forwards

22222: Synology NAS (already in use)

22223+: Available for new devices

Configuration File

Location: /etc/ssh-port-forwards.conf

Format:

device_name:external_port:vpn_ip:ssh_port

Example:

synology:22222:10.8.0.2:22
raspberrypi:22223:10.8.0.3:22

Troubleshooting

Port forward not working?

Check device is on VPN:

   ping -c 2 <vpn_ip>

Verify rules exist:

   sudo ssh-forward list
   iptables -t nat -L PREROUTING -n | grep <external_port>

Reapply rules:

   sudo ssh-forward apply

Check IONOS firewall allows the port

Need more help?

See the complete documentation: [SSH Port Forwarding Management](index.md)

Quick Reference: ssh-forward or /usr/local/bin/ssh-port-forward-manager.sh