Port 548 network problem

Question

I am trying to connect to two macs behind the same firewall. I am having port conflict issues on 548, since they both use this port for AFP.
I have the forward setup but I can only connect to one or the other. I have read a bunch of info on this but no real solutions other than buying a new firewall that can do port mapping or hacking the network config to change the port one of the machines uses (although this sounds like it is not supported or recommended by apple.
Many people have to be running into this same issue. I am surprised I haven't found any solutions. Any help would be appreciated.

Answer 1

There are several possible solutions depending largely on your router's port forwarding capability.
Some routers can only forward to the same private port number as the public (e.g. port 548 on the public interface maps to port 548 on some internal machine). Others, though, can map to different port numbers. If you have the latter you should be able to map some unused port number on the outside world to your second server, e.g.:
Public port #548 -> machine1:548
Public port #2548 -> machine2:548
In this way AFP continues to listen on port 548 on each machine, and you just tell the remote client to connect to port 2548 (or whatever other number you choose) if you want to connect to the second machine.
If that doesn't work for you since your router can't swap port numbers then the next level is to use SSH Tunneling. You setup a port forward for port 22 only, and use SSH tunneling to forward to port 548 on either machine.
There's another advantage to this approach, too, which is that your AFP session gets encrypted, adding an additional level of security.
To take this approach, setup port forwarding on port 22 to either machine, then from the remote client initiate a SSH session to that machine while using the -L switch.
If the two remote machines have the IP addresses 192.168.1.2 and 192.168.1.3 and your public IP address is 123.45.67.89 then you'd so something like:
ssh -L 5480:192.168.1.2:548 [email protected]
This tells SSH to connect to 123.45.67.89 and setup a tunnel between the local port 5480 (on your machine) which forwards to port 548 on the machine 192.168.1.2
Substituting the IP address of the other machine establishes a connection to that machine.
Once the SSH tunnel is up you tell your machine to connect to localhost:5480 - this is picked up by SSH, sent over the tunnel and forwarded to the destination machine.
The next step above that is to use a VPN. This gives your machine direct access to the entire remote network and you can access any service on any machine over the secure VPN connection. This will take a little more setup, but is easier in the long run if you have either lots of internal machines or do this often.