[SOLVED] cannot ssh from outisde LAN

doubleslash · 2011-12-13 03:15:10

I have 2 computers: desktop running ssh server and laptop trying to access it. I have configured the router to forward a certain port to my desktop. I can ssh from my laptop when it's in the local network using either the dekstop's local ip or the router's external ip. However, I cannot access it when my laptop is outisde the lan, e.g. from work or at a starbucks. Any help is greatly appreciated. Thanks.

Last edited by doubleslash (2011-12-13 16:35:31)

ewaller · 2011-12-13 03:49:08

Which port are you forwarding? (Hint: it should be decimal 22)

Hitting the external address from behind the router will cause the router to route return traffic -- regardless of the forwarding configuration.
Example, if you go out on port 80, port 80 return traffic will be forwarded because a computer behind the firewall initiated the exchange.

doubleslash · 2011-12-13 04:11:00

I'm using a non-standard port number (something other than 22) that's above 1024. Are there any restrictions? I thought any random number would do.

ewaller · 2011-12-13 04:23:17

doubleslash wrote:

I'm using a non-standard port number (something other than 22) that's above 1024.

That is okay, but... there are a couple ways to do this.

You can tell the router to accept input on a non-standard port and then re-route that to port 22 on the LAN. In this case, traffic on the LAN takes place on 22, but traffic from the Internet will come in on the non-standard port and be re-mapped.

Alternately, you can move the SSH server on the Arch box to the non-standard port. In this case, traffic on the LAN occurs on the non-standard port. The router needs to be configured to pass that non-standard port through, without remapping it to a different port. If you tell the router to re-route SSH traffic, it is likely to assume you mean port 22. That may be the crux of your problem. If you are using a non-standard port, ensure you specify the forwarding by port number; not by protocol.

doubleslash · 2011-12-13 04:34:15

I believe I'm doing the 2nd method. In my sshd_config I specify
Port xxxx

I set my router to forward the same port number xxxx to the local ip of my desktop, which is running the ssh server. So, the router config looks like this
External Port xxxx (same as in my sshd_config)
Internal Port xxxx (same number)
Protocol (both TCP and UDP)
To IP address 192.168.1.??? (my desktop's local ip)

Last edited by doubleslash (2011-12-13 04:35:42)

ewaller · 2011-12-13 04:53:12

doubleslash wrote:

I believe I'm doing the 2nd method. In my sshd_config I specify...

Looks about right. Check your email.

Last edited by ewaller (2011-12-13 04:53:26)

ewaller · 2011-12-13 05:11:52

Hi doubleslash,

In our last episode, I did manage to hit your machine. Did you see my attempts in your logs?

doubleslash · 2011-12-13 05:35:57

I saw your connection attempts. Does this mean something is wrong with my ssh client's config file? (ssh_config not sshd_config)?

skunktrader · 2011-12-13 05:37:51

Perhaps your work and Starbucks are blocking any port except http/https

ewaller · 2011-12-13 05:52:32

doubleslash wrote:

I saw your connection attempts. Does this mean something is wrong with my ssh client's config file? (ssh_config not sshd_config)?

Unlikely. In my email, I provided you with the exact command line I used. My ssh_config file is not only generic, it is entirely comments

I think skunktrader hit the nail on the head. Try using port 443 and see if you can hit that from work. 443 is normally used for HTTPS. Since that port is required for anyone pretending to provide Internet access when they are really only providing "Web Access". This practically guarantees it will not be blocked. The other nice thing about using that port is that it is expected that traffic will be encrypted, so no one notices the ssh encrypted traffic. The extra bonus is that the script kiddies don't look for SSH servers on 443 because, if they find 443 open, they assume it is open for HTTPS.

doubleslash · 2011-12-13 16:28:38

many thanks!

Arch Linux

#1 2011-12-13 03:15:10

[SOLVED] cannot ssh from outisde LAN

#2 2011-12-13 03:49:08

Re: [SOLVED] cannot ssh from outisde LAN

#3 2011-12-13 04:11:00

Re: [SOLVED] cannot ssh from outisde LAN

#4 2011-12-13 04:23:17

Re: [SOLVED] cannot ssh from outisde LAN

#5 2011-12-13 04:34:15

Re: [SOLVED] cannot ssh from outisde LAN

#6 2011-12-13 04:53:12

Re: [SOLVED] cannot ssh from outisde LAN

#7 2011-12-13 05:11:52

Re: [SOLVED] cannot ssh from outisde LAN

#8 2011-12-13 05:35:57

Re: [SOLVED] cannot ssh from outisde LAN

#9 2011-12-13 05:37:51

Re: [SOLVED] cannot ssh from outisde LAN

#10 2011-12-13 05:52:32

Re: [SOLVED] cannot ssh from outisde LAN

#11 2011-12-13 16:28:38

Re: [SOLVED] cannot ssh from outisde LAN

Board footer