I'm really confused as to how I can connect to a specific computer on my network on a computer in another network over the Internet. For example, I have a beowulf cluster constantly running at my house. I use it for hardcore computations like bruteforcing passwords from a wordlist. Now let's say I'm on my laptop but somewhere else on someone else's LAN. I know the external IP of the master node in the beowulf cluster, and it's the only one connected to the Internet out of all the nodes. However, when I get the external IP to my desktop on the same LAN as the cluster, I get the same external IP. From what I understand, the external IP will be the same for all devices on that LAN. The external IP for the beowulf cluster's master node, my desktop, and my smart TV (for example) should all be the same as they all route through the same modem, right? And the subnet mask determines which node on the LAN (the external IP shared between all the devices) the data is coming from, right? If so, how could I connect to specifically the master node in the cluster via SSH to send it information to work on if my desktop also has SSH port 22 open? If two or more machines are on a LAN, and those machines are all running SSH, and that LAN can only be referenced by the external IP shared by the two machines, how can I specify which machine in that LAN I want to connect to?

  • "And the subnet mask determines which node on the LAN (the external IP shared between all the devices) the data is coming from, right?" Nope, this is wrong. You are dealing with Network Address translation (NAT), go research how NAT works, and what port forwarding is. – Ƭᴇcʜιᴇ007 Jul 2 '15 at 17:33

Subnet masks

Subnet mask is only used to group computers in one network into subnets.

IPv4 address contains four octets, 32 bits in total. Let's say that you have few computers on your LAN and they have these IPs and subnet masks assigned:

  1. IP, mask
  2. IP, mask
  3. IP, mask
  4. IP, mask
  5. IP, mask

To determine which computers belong to which subnet, we have to apply the mask to IP addresses:

  • Convert IPs and masks to binary

    1. IP 11000000 10101000 00000000 00000001, mask 11111111 11111111 11111111 00000000
    2. IP 11000000 10101000 00000000 00000110, mask 11111111 11111111 11111111 00000000
    3. IP 11000000 10101000 00000001 00000001, mask 11111111 11111111 11111111 11111000
    4. IP 11000000 10101000 00000001 00000110, mask 11111111 11111111 11111111 11111000
    5. IP 11000000 10101000 00000001 00001100, mask 11111111 11111111 11111111 11111000
  • Perform logical "and" operation, ie. copy 1 bits where both IP and mask have 1 and fill holes with 0s

    1.    11000000 10101000 00000000 00000001
        & 11111111 11111111 11111111 00000000
        = 11000000 10101000 00000000 00000000
    2.    11000000 10101000 00000000 00000110
        & 11111111 11111111 11111111 00000000
        = 11000000 10101000 00000000 00000000
    3.    11000000 10101000 00000001 00000001
        & 11111111 11111111 11111111 11111000
        = 11000000 10101000 00000001 00000000
    4.    11000000 10101000 00000001 00000110
        & 11111111 11111111 11111111 11111000
        = 11000000 10101000 00000001 00000000
    5.    11000000 10101000 00000001 00001100
        & 11111111 11111111 11111111 11111000
        = 11000000 10101000 00000001 00001000
  • Convert results back to decimal

  • These are subnet addresses of our computers. If computers have identical subnet addresses, then they belong to the same subnet.

    • Computers 1 and 2 belong to one subnet
    • Computers 3 and 4 belong to another subnet
    • Computer 5 belongs to a third subnet

Subnets matter only inside your local network, ie. computers connected to one switch. The switch is then connected to a router which routes network packets between the switch and a modem. You probably have all three of these in one device.

Switch, router and modem

  • Switch - lets you connect more than two computers together. You can't simply solder multiple network cables together and connect them to many computers, you have to use a switch.

  • Modem - provides two-way conversion between different network standards. Your ISP uses different standard of networking than common LANs, so you need a modem that will translate their network packets to your format and your packets to their format.

  • Router - routers route packets between two networks. You can't just connect two switches in different networks to each other, you need a router between them. Router has one IP address in every network it's connected to.

Your network looks somewhat like this:

            |                                         |        
    PC1 +---------+                                   |        
            |     |                                   |        
            |   +--------+   +--------+   +-------+   |        
    PC2 +-------+ Switch +---+ Router +---+ Modem +-------+ ISP
            |   +--------+   +--------+   +-------+   |        
            |     |                                   |        
    PC3 +---------+                                   |        
            |                                         |        

How does routing work?

Computers on the left have three IP addresses, let's say:


There's also your router's LAN-side address.

But on the right side you have only one IP address, so-called "public IP". It's the router's Internet-side address. When someone from the outside wants to talk to a computer inside your network, how does he specify which one he wants to talk to?

The answer is: he can't. You can't just start talking to a computer inside your network from the outside. People on the Internet can only communicate with your router.

That kind of networking would be quite useless, though, and apparently you can download data from the Internet. So how does it work? It works because you have initiated the connection. When a computer inside the network tries to communicate with the outside world, the router assigns one of its Internet-side ports to a port of that computer. If someone replies to that port, the router knows where it should forward these packets. This technique is called Network Address Translation (NAT for short).

How do you connect to computers inside your network from the outside?

You can't without configuring your router properly, because it's the computer inside your network that has to initiate the connection. It would work only if computer on the other end has public IP, which is unlikely. The network probably looks like this:

    +----------------+                            +-----------------------+
    |                |                            |                       |
    |  Your cluster  |                            |     Other network     |
    |                |                            |                       |
    |    PC1 +---+   |                            |   +---+ Other PC      |
    |            |   |     +----------------+     |   |                   |
    |            |   |     |                |     |   |     The computer  |
    |    PC2 +-------------+  THE INTERNET  +-------------+ you're using  |
    |            |   |     |                |     |   |     to connect    |
    |            |   |     +----------------+     |   |                   |
    |    PC3 +---+   |                            |   +---+ Other PC      |
    |                |                            |                       |
    +----------------+                            +-----------------------+

Both of these networks have routers on their boundary and both of these routers use NAT, so setting up backward connection won't work.

How to connect to your cluster?

You have to configure port forwarding in your router.

Port forwarding permanently binds one of router's Internet-side ports to some port of one of your computers.

For example you can forward port 5432 of your router to port 22 (default SSH port) of PC1 in your cluster. Then you can SSH to your public IP on port 5432 and you'll actually connect to PC1 on port 22.

If you want to connect to another PC in your cluster, you have two ways to do it:

  • Forward another port to another machine

  • Use PC1. PC1 is connected to your LAN and it can talk to other computers in LAN without routing or NAT. You can SSH into PC1 through forwarded port and then SSH from PC1 to PC2. This is less efficient than direct connection, but doesn't require any additional configuration.

  • That is one hell of an answer. Thank you very much! – Zulfe Jul 2 '15 at 18:24
  • Such a wonderful Answer. Sad to see only 3 upvotes. +1 from me. You saved my day. – kris123456 Oct 21 at 13:31

I think you should look up how IPv4 subnetting works as you've got the wrong end of the stick, and then read about NAT-PMP. However, in a nutshell:

You have two networks, the internet and your network. These are completely separate, save for the NAT router in the middle. When you want to connect to the outside world (i.e. a subnet outside your own) your computer contacts the "gateway" or "default route". This will be your NAT router. The router then passes the traffic back and forth between your computer and the internet using an internal, temporary set of rules describing the connection.

To connect to your network from the outside world you have to set up NAT port mapping rules. Your external IP address is just that; one IP address identifying your router's WAN port, its connection to the internet, which all your computers share using NAT. Using your router's interface you must set rules up allowing traffic to certain ports on your router's WAN interface to be redirected to services on your internal network.

e.g. You have three computers -,,, subnet masked These three computers are all running SSH on port 22. Your external IP address is

To access the three separate SSH servers you must map three external ports to the three internal IP address / port combinations. e.g. -> -> ->

This functionality is built into your NAT router - you should be able to find specific instructions to set this up for your model of router. I reccommend that you go and do some reading first though!


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.