Member Avatar for robert3353

Hello,
I want to make one of my computers available to a friend who lives in Poland to assist him in his efforts in building a Linux distro he develops. He does not always have access to a 64bit system and I am not in a great finacial situation to be able to give him a system so I thought he might be able to remotely log into one of my Linux boxes and use it remotely to assist with his development efforts. How can I configure my network/router so that this is the only computer that is accessable to him? So far I do not have everything configured in a formal network, they are just a few computers (some running Windows 7 and some Linux) a smart tv as well as a PS3 plugged in to my FIOS router to gain access to the internet. Is there a way to easily do this? Do any of you know of any tutorials on line that may explain how to accomplish this?
Thanks for your assistance
Robert,

  • 3 Contributors
  • 2 Replies
  • 247 Views
  • 3 Hours Discussion Span
  • Latest Post Latest Post by CimmerianX

Dani AI

Generated

A compact, practical checklist to let only one machine on your network be reachable from outside, plus concrete SSH and firewall examples. is right that the router needs an inbound rule; is right to add host-level protections. Do these steps in order and test from a network that is not your home LAN before giving access.

  1. Reserve the host IP on your router (or set a static IP on the box). This keeps the forward target stable.
  2. Forward a single WAN port to that host’s SSH port (you can change the SSH port to something non‑standard). If your ISP gives you a private WAN address (CGNAT), inbound forwarding won’t work — contact the ISP or use a VPN solution instead.
  3. Harden SSH on the host: create an SSH keypair for your friend, disable password login, disallow root, and restrict allowed usernames. Example /etc/ssh/sshd_config snippets:
Port 2222
PermitRootLogin no
PasswordAuthentication no
AllowUsers friendusername

Restart sshd after changes.

  1. Enforce a source-IP restriction on the host firewall (safer than relying solely on router UI). Example iptables rules (replace x.x.x.x with your friend’s public IP and adapt port):
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 2222 -s x.x.x.x -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 2222 -j DROP

Or, with UFW: ufw allow from x.x.x.x to any port 2222 proto tcp.

  1. Add layered protections: use fail2ban, keep the system patched, give the friend a non‑privileged account, and rotate keys/passphrases if needed. Consider a VPN (WireGuard/OpenVPN) instead of exposing SSH directly; it’s simpler to audit and can give access to more services safely.

Final notes: verify the friend’s public IP before applying firewall rules, test end-to-end from an external network, and keep logs for a little while to spot any unexpected access attempts.

Recommended Answers

All 2 Replies

Member Avatar for JorgeM

Hello Robert,

So to configure your router to allow unsolicited inbound access is not terribly difficult. You simply need to now what port(s) to open. When you log into your router, look for the tab/options related to Port Forwarding/NAT.

In addition, you want to restrict the IP that can come in. That option will depend on whether your router has the ability to create firewall rules which would allow you to restrict based on source IP.

If you need your friend's IP address and he doesnt know what the public address is, have him visit a site that can detect the public ip such as:

Edited by JorgeM
Member Avatar for CimmerianX

Just as an additional note.... if the router can't restrict access based on source IP, use IPTABLES on the host OS along with FAIL2BAN... just in case you are paranoid like me.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.