I have a small home network, and I’m having trouble accessing one of the computers on that network. The home network is NAT’ed, and I've set up some port forwarding and a dynamic DNS.

* `rye` sits on my home network. Public-facing port 2222 of my router is forwarded to `rye`’s port 22.
* `sorghum` sits on my home network. Public-facing port 22 is forwarded to `sorghum`’s port 22.
* `teff` sits on an external network.

I now present the following strange scenario:

1. I can SSH from `teff` to `dmwit.duckdns.org:2222`, so I believe the dynamic DNS is working correctly, the port-forwarding to `rye` is working correctly, and `rye` is accepting connections from other computers correctly (i.e. isn’t blocking things at the firewall level).
2. I can SSH from `rye` to `dmwit.duckdns.org:22`, so I believe the port-forwarding to `sorghum` is working correctly, and `sorghum` is accepting connections from other computers correctly.
3. From `rye`, asking Netcat to connect to a port on `sorghum` that is being blocked by `sorghum`’s firewall results in “No route to host,” while from `teff` asking Netcat to connect to `dmwit.duckdns.org:22` results in “Connection timed out,” so I believe `sorghum`’s firewall is not blocking this connection.
4. I cannot SSH from `teff` to `sorghum` (the connection times out).

I find this a bit baffling; evidence suggests that each piece in the chain is working correctly, yet the whole chain is broken. I have two concrete questions that are somewhat unrelated to each other:

1. How can this kind of thing be debugged further? What tools can I use to find more detail on what's going wrong?
2. How do I fix it so that I can ssh from teff to sorghum?

**EDIT:** I’ve found a [vaguely related question](https://unix.stackexchange.com/questions/108162/ssh-connection-timed-out-its-not-client-or-server-what-now) which suggested trying Traceroute. On `teff` I can see a significant difference between the Traceroute outputs for ports 22 and 2222:

```
% traceroute -p 2222 -T dmwit.duckdns.org
traceroute to dmwit.duckdns.org (75.164.159.92), 30 hops max, 60 byte packets
 1  gw-40.galois.com (192.168.40.1)  13.722 ms  13.723 ms  17.016 ms
 2  66.162.129.25 (66.162.129.25)  17.957 ms  18.106 ms  18.289 ms
 3  64-129-238-66.static.twtelecom.net (64.129.238.66)  18.949 ms sea2-pr2-xe-0-3-0-0.us.twtelecom.net (66.192.243.34)  19.250 ms 64-129-238-66.static.twtelecom.net (64.129.238.66)  19.242 ms
 4  64.132.69.2 (64.132.69.2)  20.052 ms  20.291 ms  20.284 ms
 5  ptld-agw1.inet.qwest.net (67.14.49.2)  22.658 ms  22.942 ms  22.932 ms
 6  207.225.86.146 (207.225.86.146)  22.924 ms  8.583 ms  8.591 ms
 7  * * *
 8  75-164-159-92.ptld.qwest.net (75.164.159.92)  31.056 ms  29.508 ms  29.714 ms
% traceroute -p 22 -T dmwit.duckdns.org -m 60
traceroute to dmwit.duckdns.org (75.164.159.92), 60 hops max, 60 byte packets
 1  gw-40.galois.com (192.168.40.1)  1.660 ms  5.667 ms  5.912 ms
 2  66.162.129.25 (66.162.129.25)  5.901 ms  12.563 ms  12.555 ms
 3  64-129-238-66.static.twtelecom.net (64.129.238.66)  14.227 ms sea2-pr2-xe-0-3-0-0.us.twtelecom.net (66.192.243.34)  12.796 ms  12.787 ms
 4  64.132.69.2 (64.132.69.2)  12.778 ms  12.769 ms  12.762 ms
 5  ptld-agw1.inet.qwest.net (67.14.49.2)  13.955 ms  13.946 ms  13.937 ms
 6  207.225.86.146 (207.225.86.146)  13.931 ms  10.297 ms  10.256 ms
 7  * * *
 8  * * *
 9  * * *
10  * * *
11  * * *
<snip>

```

The second one goes on like that for 20 more lines (and continues further if you increase the maximum hop count). I’m not 100% sure how to interpret this, so add a third question:

3. What does this traceroute output mean?