Connect via SSH/Samba from 1 box to a hidden box (NAT/PAT?) setup?

What you have termed PAT would work. You will need to have iptables running(or some customizable firewall). Then run the following commands:

iptables -t nat -A PREROUTING -p tcp --dport 22 -p DNAT --to-destination 192.168.0.2
iptables -t nat -A PREROUTING -p tcp --dport 135:139 -p DNAT --to-destination 192.168.0.2
iptables -t nat -A PREROUTING -p tcp --dport 445 -p DNAT --to-destination 192.168.0.2
service iptables save
echo 1 > /proc/sys/net/ipv4/ip_forward

In the file /etc/sysctl.conf, change the line:

net.ipv4.ip_forward = 0

to

net.ipv4.ip_forward = 1

Can you ssh into box B and then do another ssh into box C from there? Or does that not solve your specific problem?

EDIT (In response to the comment from Ian Vaughan): Have you looked at the route command to set up a default route, try route --help at the command line for more info (or possibly man route).

PAT would work for SSH.

For Samba try this:

1. setup A as the master browser for the network segment in the A side (assuming B is not a server and merely passing on packets)
2. setup C to announce itself to A. See 'remote announce' and 'remote browse sync' of smb.conf
3. setup a static route in C for the A network (and vice versa if needed)
4. allow forwarding at B

when C announces its presence to A, stations in A's segment (those connected to the switch) will see it using A as the master browser.

smb broadcasts cannot normally traverse network subnets so 'remote announce' makes a server known to another server (and likewise stations) in another subnet.

B should be the default gateway for stations on both sides so packets gets properly routed. If not, static routes need to be setup in each station.

This works both ways: if there are stations in the C segment that need to access server A, A should 'announce' itself to C.

Hope this helps.

Your host B is known as a dual homed host. You need for B to route traffic between subnets 192.168.0 and 192.168.109 Configure C (and any other hosts on 192.168.0 subnet) to use 192.168.0.1 as default gateway. Configure B to use the switch as default gateway (probably already is) Configure B to route subnet 192.168.0 traffic out 192.168.0.1 Configure your switch to route subnet 192.168.0 traffic to 192.168.109.15 That will make subnet 192.168.0 accessible to all routable traffic.

You can then use firewall features in the switch and/or in B to obtain the security restrictions you want.