Labthrift Labthrift What to buy. What to skip. Why.

Written 9 Sep 2026. This is a how-to, not a product card.

NAT is why SSH stays inside

The house shares one public address. Inbound SSH is dropped unless you punch a hole. Don't forward port 22.

The leftover box has a house number like 192.168.1.50. Phones and laptops on the same Wi-Fi can reach it. A café laptop cannot. That is not a broken SSH. That is the router doing its job.

What NAT is

Every device in the house shares the one public address the ISP gave the router. Outbound tabs work because the router remembers who asked. Inbound knocks have no memory, so they stop at the router. The weekend SSH walk already assumes that: SSH from the couch on the house network only.

What people get wrong

A forum will say “forward port 22.” That punches a hole so the whole internet can guess the leftover-box password. Fail2ban does not make that safe. A mesh VPN later (Tailscale and friends) is a different door, still not a router hole. This weekend: leave the settings alone. The how-to is keep the computer on the house network.

Where to write it

Write the house name and number in Lab plan → House names after SSH works. Tick nothing for a NAT quiz. The idea as cards: the ByteRush NAT lesson. Same login: one Labthrift passkey.

What next

Find the box: find it on the house network. Login: SSH from the couch. Boundary: keep it on the house network.

Optional: house-only vs a forwarded 22 as a sandbox in ByteRush (NAT lesson) — same Labthrift passkey as Plan. Skip if you just want to keep reading.

Skip

Sources

House boundary: keep the computer on the house network. Lessons: ByteRush NAT.

Also on this topic

Keep the computer on the house networkDon't forward port 22. Skip if you never opened the router. SSH from the couchHouse network only. Password first. How the three Labthrift sites fitNotes, Plan, ByteRush. Same path. One Labthrift passkey.