Arch Linux

dakota

Member

Registered: 2016-05-20

Posts: 417

SSH through Firewall - Bad Syntax or Bad Firewall Config?

What is the syntax for connecting to an ssh server, when it is located behind a firewall and a firewall rule has been created for port forwarding?

This seems like a very simple question with an obvious answer, but I must be missing something very basic because I can't get it to work.

When the client and server are on the SAME side of the firewall, I execute:

$ ssh -p <sshServerPort> <sshServerIP>
$ ssh -p 40001 10.10.32.101 

... (using a non-standard port 40001 and key exchange) and it connects just fine.

When I move the ssh server behind the firewall, I point the previous command to the WAN port on the firewall, and I create a firewall rule.

$ ssh -p <firewallPort> <firewallWANIP>
$ ssh -p 40001 10.10.32.200

OPNsense firewall port-forward rule:

Interface = WAN
TCP/IP version = IPv4
Protocol = TCP
Source = any
Source port range = any
Destination = This Firewall
Destination port: 40001
Redirect target IP = 192.168.1.101
Redirect target port = 40001

What I end up with is:

kex_exchange_identification: read: Connection reset by peer
Connection reset by 10.10.32.200 port 40001

This suggests that the ssh command is being interpreted as an attempt to connect to the firewall, rather than a command that should be forwarded on to the ssh server.

Is my ssh connection syntax wrong? Or should I be looking at the firewall setup?

Cheers,

---

"Before Enlightenment chop wood, carry water. After Enlightenment chop wood, carry water." -- Zen proverb