Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to configure my home network so I can access a specific computer from outside my home network. For example, SSH to my desktop computer at home, or run a web server (routing port 80 requests), or screen sharing with VNC. I am using Macs and have an Airport Extreme as my router. I assume I need to configure the router to forward ports so that I can access it using the external IP address, but I'm new to this sort of thing so I don't know the right way to go about it.

How might one go about configuring their home network this way?

share|improve this question
The feature you're looking for is called DMZ (DeMilitarized Zone). Enable it for your computer's IP and that's it. – gronostaj Feb 28 '13 at 21:31

a NAT forward rule from the outside in, is just a simple mapping from a public port to a internal ipaddress and port, saying "IF a packet is recieved on this public port, forward it to server X at port Y".

Go to and lookup your model of router for instructions on how to make a forward rule. you generally want one forward rule for each service you plan to expose.

if all the services are on the same server, and your router can support it, you can create a DMZ rule that just sends all unsolicited invbound traffic to your server, so you don't need to create multiple rules for each protocol, but that means that your server is completely exposed so you have to lock it down to do so safely.

SSH can be forwarded safely, if you configure it to use Keys rather than passwords, but it is very dangerous to use a kinda weak password for ssh, and not too much safer to use a pretty strong one. shifting ports is a good idea, but far from bullet proof. there was an article on slashdot just this week about distributed bruteforce scanners searching high ports for ssh.

VNC is NOT safe for forwarding without some kind of wrapper, like ssh. once you have the port forwarding set up, you shoudl be able to find copious tutorials on how to set up vnc for tunneled access without directly exposing vnc to the internet.

good luck

share|improve this answer
cool, thanks. I'll look into this info. – Andrew Feb 28 '13 at 22:04

You are right, you need to configure the Airport Extreme to forward ports, which is quite straightforward.

First, you need to know which port numbers are involved (see this KB article), in your case:

  • 22/tcp (SSH)
  • 80/tcp (HTTP)
  • 5900/tcp (VNC) (caution, VNC is insecure)

Second, the Mac you want to access from the outside must have a known, static IP address. Configure it like this:

  1. Open System Preferences>Network>kWi-Fi>Advanced>TCP/IP.
  2. Change the 'Configure IPv4' entry to 'Using DHCP with manual address'.
  3. Enter an IP address which coincides with the IP address in the Router field but substituting the last number with a high number between 201 and 254 (in the picture below I typed in as DHCP usually reserves from address .2 to .200 (see this article for more information):

enter image description here

Third, open Airport Utility in the Applications/Utilities folder, select your Airport Extreme and press Edit:

enter image description here

Choose the Network tab and press + in the Port Settings section:

enter image description here

Add for each protocol a port forwarding entry and specify as private IP address the static IP address of your Mac as configured above:

enter image description here

The private TCP port is the port on your Mac. Those are the ports I listed above. The public TCP port is the port on your Airport Extreme. You can use any port here, but I recommend that you use the same ports as on your Mac to keep things simple.

Save each entry, apply the new configuration and wait until the base station restarts.

Now you can connect to your Mac using your Aiport Extreme's IP address.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.