[SOLVED] Cannot SSH into my Arch Desktop from outside the LAN

imjuanes · 2020-08-19 04:15:32

Level 1 Arch user here - compassion please. I am able to SSH into my desktop (running Arch) from my laptop (running Ubuntu) if I am connected to the wifi in my house. My desktop is connected to the internet via Ethernet. However, as soon as I attempt to do it from the outside it doesn't work. If you can provide me with the commands you'd like me to run in order to help you diagnose my problem that'd be great. Below are a couple that I ran based on what I've seen on the internet that might be helpful. Thank you in advance!

From my desktop:

juanes@juanes netctl]$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 18:60:24:71:32:9a brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.155/24 brd 192.168.1.255 scope global dynamic noprefixroute enp2s0
       valid_lft 79181sec preferred_lft 79181sec
    inet 192.168.1.23/24 brd 192.168.1.255 scope global secondary noprefixroute enp2s0
       valid_lft forever preferred_lft forever
    inet 192.168.1.87/24 brd 192.168.1.255 scope global secondary noprefixroute enp2s0
       valid_lft forever preferred_lft forever
    inet 192.168.1.165/24 brd 192.168.1.255 scope global secondary dynamic noprefixroute enp2s0
       valid_lft 79640sec preferred_lft 68840sec
    inet6 2600:1700:9758:69d0:1a4a:42c9:c9e1:b3f5/64 scope global dynamic mngtmpaddr noprefixroute 
       valid_lft 3184sec preferred_lft 3184sec
    inet6 2600:1700:9758:69d0::47/128 scope global dynamic noprefixroute 
       valid_lft 3271sec preferred_lft 3271sec
    inet6 2600:1700:9758:69d0:7ce9:ac01:aab4:22c/64 scope global dynamic noprefixroute 
       valid_lft 3184sec preferred_lft 3184sec
    inet6 fe80::3392:3099:ecc4:ceff/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: wlp3s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
    link/ether 62:02:21:56:95:45 brd ff:ff:ff:ff:ff:ff

[juanes@juanes netctl]$ systemctl status sshd
* sshd.service - OpenSSH Daemon
     Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: disabled)
     Active: active (running) since Tue 2020-08-18 20:07:53 PDT; 1h 6min ago
   Main PID: 2911 (sshd)
      Tasks: 1 (limit: 19124)
     Memory: 1.6M
     CGroup: /system.slice/sshd.service
             `-2911 /usr/bin/sshd -D

(While attempting to SSH From my laptop)

[juanes@juanes netctl]$ sudo tcpdump -lnni enp2s0 port 22 -vv
tcpdump: listening on enp2s0, link-type EN10MB (Ethernet), capture size 262144 bytes
^C
0 packets captured
0 packets received by filter
0 packets dropped by kernel

Last edited by imjuanes (2020-08-22 05:29:12)

imjuanes · 2020-08-19 04:18:30

(From my laptop, attempting to SSH)

juanes@juanes:~/Desktop/NOCI$ ssh -vvv juanes@192.168.1.155
OpenSSH_7.6p1 Ubuntu-4ubuntu0.3, OpenSSL 1.0.2n  7 Dec 2017
debug1: Reading configuration data /home/juanes/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: resolving "192.168.1.155" port 22
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to 192.168.1.155 [192.168.1.155] port 22.
debug1: connect to address 192.168.1.155 port 22: Connection timed out
ssh: connect to host 192.168.1.155 port 22: Connection timed out

Last edited by imjuanes (2020-08-19 14:55:07)

seth · 2020-08-19 05:44:09

Please edit your posts and wrap the command I/O (and contents of files) in code tags, https://bbs.archlinux.org/help.php#bbcode
Also, for the future, edit your posts and mend them unless somebody has posted interim.

On topic: please specify "from the outside" - do you mean from a different (sub-)network (starbucks…) or just when you physically move the laptop outdoors but supposingly are still in the same subnet?
Can you still "ping 192.168.1.155"?
Can you "ping 8.8.8.8"?
What's the output of "ip a; ip r"? (all on the laptop when the connection fails "outside")

Scimmia · 2020-08-19 05:47:16

Ug, this is going to get into networking 101. You need to do some reading on NAT and your external IP vs internal IP.

Last edited by Scimmia (2020-08-19 06:01:18)

drcouzelis · 2020-08-19 12:21:35

Hi.

I have my computer configured to do what you are trying to accomplish. I can use SSH from anywhere (like from my phone when I'm in the grocery store) to access my Arch Linux computer that is in my house. As Scimmia mentioned, there are basic concepts that need to be understood, but most importantly there are two things.

There is no list of commands to enter to achieve this functionality. Instead, it will involve a lot of learning, configuration of your computer, configuration of your router, signing up for services online, and probably other things I've missed.
As soon as your computer is accessible by you from anywhere, it is potentially accessible by ANYONE from anywhere, from any computer, from any country. Even if you are able to fumble your way through getting this to work, you NEED to take security seriously BEFORE you start using it.

Also as Scimmia said, it's important to understand the difference between your internal IP address and your external IP address. Do an internet search for "what is my ip address". What is the result? It's NOT "192.168.1.155". Do you know why?

Providing access to your SSH server from anywhere involves the following steps.

Signing up for a domain name. If you don't have a domain name then you'll need to access your SSH server by IP address, and I DON'T mean "192.168.1.155". That's your local IP address. You'll be accessing the IP address that is used by your router. Some domain name services cost money, some are free, some are REALLY sketchy and dangerous.
Updating your domain name to point to the correct IP address. You most likely have an IP address that automatically changes every few days. If you don't do this step, then you (or your domain name) won't know where to find your server when it changes! There are ways to automate this so you don't have to worry about it.
Configure your router. Your router is configured to block requests for SSH. You need to find the model, figure out how to login to it, secure it, and then enable port forwarding. So when you request an SSH session to your router, the router will forward the request to your SSH server.
Secure your SSH server. When your SSH server is online for the whole world to see, people / computers from around the world will begin attempting to break in to it. You NEED to think about security!

Good luck!

Last edited by drcouzelis (2020-08-19 12:27:52)

imjuanes · 2020-08-19 15:00:33

seth wrote:

Please edit your posts and wrap the command I/O (and contents of files) in code tags, https://bbs.archlinux.org/help.php#bbcode
Also, for the future, edit your posts and mend them unless somebody has posted interim.

Done, thank you for letting me know. Mending as in not have two separate inital posts?

seth wrote:

On topic: please specify "from the outside" - do you mean from a different (sub-)network (starbucks…) or just when you physically move the laptop outdoors but supposingly are still in the same subnet?
Can you still "ping 192.168.1.155"?
Can you "ping 8.8.8.8"?
What's the output of "ip a; ip r"? (all on the laptop when the connection fails "outside")

What I refer to as "the outside" is either from a hotspot in my phone or from school, so I'll update my vocabulary to call it "from a different network." I'll post the output of those commands ran from my laptop in one second.

imjuanes · 2020-08-19 15:03:47

Scimmia wrote:

Ug, this is going to get into networking 101. You need to do some reading on NAT and your external IP vs internal IP.

Yes it is... Thank you for pointing me towards what I need to learn to do this.

imjuanes · 2020-08-19 15:15:11

drcouzelis wrote:

Providing access to your SSH server from anywhere involves the following steps.

Sounds like a more-involved process than what I thought it was going to be! I used to have my desktop at school, hooked up to the Ethernet, and I'd be able to SSH into it without a problem. I thought it'd be the same at home. Thank you for outlining the steps I need to carry out - I think I understand them well enough to give it a try. And I promise I'll keep security in mind!

imjuanes · 2020-08-19 15:20:51

Here's the output of these from my laptop, while on my mobile hotspot.

seth wrote:

Can you still "ping 192.168.1.155"?
Can you "ping 8.8.8.8"?
What's the output of "ip a; ip r"? (all on the laptop when the connection fails "outside")

juanes@juanes:~$ ping 192.168.1.155
PING 192.168.1.155 (192.168.1.155) 56(84) bytes of data.
^C
--- 192.168.1.155 ping statistics ---
18 packets transmitted, 0 received, 100% packet loss, time 17393ms

juanes@juanes:~$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=114 time=63.9 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=114 time=54.2 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=114 time=71.6 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=114 time=59.0 ms
64 bytes from 8.8.8.8: icmp_seq=5 ttl=114 time=77.7 ms
^C
--- 8.8.8.8 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4005ms
rtt min/avg/max/mdev = 54.243/65.329/77.740/8.477 ms

juanes@juanes:~$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: wlp59s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether a0:51:0b:0a:8b:8d brd ff:ff:ff:ff:ff:ff
    inet 192.168.43.217/24 brd 192.168.43.255 scope global dynamic noprefixroute wlp59s0
       valid_lft 3377sec preferred_lft 3377sec
    inet6 2600:1010:b05b:3f75:acaf:b62a:31e5:fa5/64 scope global temporary dynamic 
       valid_lft 3379sec preferred_lft 3379sec
    inet6 2600:1010:b05b:3f75:baa4:e9da:8e8c:bb83/64 scope global dynamic mngtmpaddr noprefixroute 
       valid_lft 3379sec preferred_lft 3379sec
    inet6 fe80::dd7d:206c:661d:27df/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
    link/ether 52:54:00:4f:57:ec brd ff:ff:ff:ff:ff:ff
    inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
       valid_lft forever preferred_lft forever
4: virbr0-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc fq_codel master virbr0 state DOWN group default qlen 1000
    link/ether 52:54:00:4f:57:ec brd ff:ff:ff:ff:ff:ff

juanes@juanes:~$ ip r
default via 192.168.43.1 dev wlp59s0 proto dhcp metric 600 
169.254.0.0/16 dev virbr0 scope link metric 1000 linkdown 
192.168.43.0/24 dev wlp59s0 proto kernel scope link src 192.168.43.217 metric 600 
192.168.122.0/24 dev virbr0 proto kernel scope link src 192.168.122.1 linkdown

ewaller · 2020-08-19 16:16:36

Let us take a different tack. drcouzelis is the only one to mention 'router' so far in this thread. You ambiguously stated that 'My desktop is connected to the internet via Ethernet.'
I can see the IP address of your machine is a private address that is not routable on the Internet (this has also been alluded to in the thread).

Is your computer connected to an port on the wall at work, or in a dorm room, or an apartment? Or did your ISP give you a router or modem into which you are connected? Or, is it your own router?

imjuanes · 2020-08-19 16:57:56

ewaller wrote:

Is your computer connected to an port on the wall at work, or in a dorm room, or an apartment? Or did your ISP give you a router or modem into which you are connected? Or, is it your own router?

ewaller,

Right now it's connected to a router in my house, which my ISP provided. What I was telling drcouzelis is that when it was hooked up to a port at work/school it worked no problem.

seth · 2020-08-19 19:11:33

Yeah… see: 192.168.0.0/16 is a private address range - even if your "outside" subnet wasn't 192.168.43.0/24 but - like your home net - 192.168.1.0/24: it would still not be the same network segment.
(That's why I wanted to know whether "outside" was simply "outdoors")

Your router at home get's a WAN IP from your ISP - that is the IP you need to contact: https://ipinfo.io/ip will print it for you (if you open the link at home, when you're at your school, it's the WAN IP of the school network)
You then need to configure the router to forward attempts on a certain port to your local IP (192.168.1.155)

A pitfall here may be that you don't get a real™ IPv4, you will then have to contact the IPv6 and allow that inbound traffic in the router.

Basically what drcouzelis already said AND: you *HAVE* to and I mean ***HAVE TO!!!*** work through at least https://wiki.archlinux.org/index.php/Security#SSH to not hand your desktop to hostile players ("hackers")
As long as the ssh port is not opened to the WAN by the router, those would have to exploit eg. a bug in your router first to invade your local network, but if /you/ can access the system from outside™, *anyone* can.

fukawi2 · 2020-08-20 03:46:11

imjuanes wrote:

I used to have my desktop at school, hooked up to the Ethernet, and I'd be able to SSH into it without a problem.

Your school is probably fortunate enough to have a large allocation of public IPv4 address space (such as a /16, which has 65,534 addresses in it), and therefore can afford to assign a public address to each device on their network (odd that they wouldn't firewall inbound traffic, but hey, "education"....). At home, you'll be lucky if you even have 1 public IPv4 address, which has to be shared between all the devices on your network. This is done by the router using NAT, as others have alluded to.

imjuanes · 2020-08-20 06:13:44

I successfully managed to screw my Ethernet connection altogether in attempting to set up a static IP address and having my router forward to it I guess I'll be making another newbie corner post to get some help with that... Sorry for disappointing everyone

imjuanes · 2020-08-20 21:54:22

seth wrote:

Yeah… see: 192.168.0.0/16 is a private address range - even if your "outside" subnet wasn't 192.168.43.0/24 but - like your home net - 192.168.1.0/24: it would still not be the same network segment.
(That's why I wanted to know whether "outside" was simply "outdoors")
Your router at home get's a WAN IP from your ISP - that is the IP you need to contact: https://ipinfo.io/ip will print it for you (if you open the link at home, when you're at your school, it's the WAN IP of the school network)
You then need to configure the router to forward attempts on a certain port to your local IP (192.168.1.155)
A pitfall here may be that you don't get a real™ IPv4, you will then have to contact the IPv6 and allow that inbound traffic in the router.
Basically what drcouzelis already said AND: you *HAVE* to and I mean ***HAVE TO!!!*** work through at least https://wiki.archlinux.org/index.php/Security#SSH to not hand your desktop to hostile players ("hackers")
As long as the ssh port is not opened to the WAN by the router, those would have to exploit eg. a bug in your router first to invade your local network, but if /you/ can access the system from outside™, *anyone* can.

Hi again Seth,

So I managed to fix the ethernet connection with your help from the other post. Also, I configured the router to open up a port and forward it to my local IP address. Now, the issue is that when I visit https://ipinfo.io/ip to retrieve the IP that I need to contact from the outside I receive a

This site can’t be reachedhttps://ipinfo.io/ip is unreachable.
ERR_ADDRESS_UNREACHABLE

error (yes, my internet is working.) Note that before the whole messing-up-my-ethernet detour I was able to receive an IP address from this website. It's possible that I messed up something in the process. I get the feeling it has to do with messing up my IPv4, since when I visit https://whatismyipaddress.com/ it finds an IPv6 but not an IPv4.

imjuanes · 2020-08-21 06:08:40

Alright, here is where I am at. I managed to set up a static IP address via netctl using their ethernet-static sample file, which I called enp2s0. I configured my router to forward calls to a particular port to that static IP address. Nonetheless, I still cant get a WAN IP address from https://ipinfo.io/ip nor what I think should be the same IPv4 from https://whatismyipaddress.com/.

Here's a possibly relevant piece of information. I cannot connect to the internet via that static IP address (I need to have the wifi on.) Here's the output of ip a while using "en2s0"

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 18:60:24:71:32:9a brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.23/24 brd 192.168.1.255 scope global noprefixroute enp2s0
       valid_lft forever preferred_lft forever
3: wlp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 90:61:ae:51:32:cc brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.168/24 brd 192.168.1.255 scope global dynamic noprefixroute wlp3s0
       valid_lft 85191sec preferred_lft 85191sec
    inet6 2600:1700:9758:69d0::45/128 scope global dynamic noprefixroute 
       valid_lft 2392sec preferred_lft 2392sec
    inet6 2600:1700:9758:69d0:d2e:50c2:ac27:c1be/64 scope global dynamic noprefixroute 
       valid_lft 3143sec preferred_lft 3143sec
    inet6 fe80::cf5f:c6d1:6359:e174/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever

Also, there is another "Wired connection 1" that starts by default after rebooting, which does connect to the internet just fine. I am also able to get a number from both https://ipinfo.io/ip and https://whatismyipaddress.com/. Here's the output from ip a while on "Wired connection 1"

[juanes@juanes ~]$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 18:60:24:71:32:9a brd ff:ff:ff:ff:ff:ff
    inet 99.145.194.62/22 brd 99.145.195.255 scope global dynamic noprefixroute enp2s0
       valid_lft 8553558sec preferred_lft 8553558sec
    inet6 2600:1700:9758:69d0::49/128 scope global dynamic noprefixroute 
       valid_lft 3560sec preferred_lft 3560sec
    inet6 2600:1700:9758:69d0:7ce9:ac01:aab4:22c/64 scope global dynamic noprefixroute 
       valid_lft 3592sec preferred_lft 3592sec
    inet6 fe80::3392:3099:ecc4:ceff/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: wlp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 90:61:ae:51:32:cc brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.168/24 brd 192.168.1.255 scope global dynamic noprefixroute wlp3s0
       valid_lft 85137sec preferred_lft 85137sec
    inet6 2600:1700:9758:69d0::45/128 scope global dynamic noprefixroute 
       valid_lft 2337sec preferred_lft 2337sec
    inet6 2600:1700:9758:69d0:d2e:50c2:ac27:c1be/64 scope global dynamic noprefixroute 
       valid_lft 3592sec preferred_lft 3592sec
    inet6 fe80::cf5f:c6d1:6359:e174/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever

Last edited by imjuanes (2020-08-21 06:23:53)

imjuanes · 2020-08-21 08:14:13

I can now access the internet exclusively on enp2s0, but only non IPv4-based sites. Heres

ip a

while on enp2s0. If you compare with the

ip a

from the previous post you'll see three new inet6, which are how I guess I am able to connect to the internet.

[juanes@juanes netctl]$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 18:60:24:71:32:9a brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.23/24 brd 192.168.1.255 scope global noprefixroute enp2s0
       valid_lft forever preferred_lft forever
    inet6 2600:1700:9758:69d0::49/128 scope global dynamic noprefixroute 
       valid_lft 3064sec preferred_lft 3064sec
    inet6 2600:1700:9758:69d0:8efb:d6a7:3635:9fa0/64 scope global dynamic noprefixroute 
       valid_lft 3360sec preferred_lft 3360sec
    inet6 fe80::ca04:faf1:46f4:ccca/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: wlp3s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
    link/ether 3e:95:62:ec:bc:b2 brd ff:ff:ff:ff:ff:ff permaddr 90:61:ae:51:32:cc

The question remains, why does the IPv4 not work? Any superior knowledge would be appreciated, it's been long hours trying to get this to run

imjuanes · 2020-08-21 09:05:19

One more piece of information... If I have both wifi and enp2s0 up, and run

sudo tcpdump -lnni enp2s0 port 4831 -vv

while attempting to ssh from my laptop I get something

[juanes@juanes ssh]$ sudo tcpdump -lnni enp2s0 port 4831 -vv
tcpdump: listening on enp2s0, link-type EN10MB (Ethernet), capture size 262144 bytes
02:00:04.276433 IP (tos 0x0, ttl 48, id 48071, offset 0, flags [DF], proto TCP (6), length 60)
    174.194.151.200.10975 > 192.168.1.168.4831: Flags [S], cksum 0x2f0a (correct), seq 2880784156, win 64240, options [mss 1388,sackOK,TS val 549110823 ecr 0,nop,wscale 7], length 0
02:00:04.975619 IP (tos 0x0, ttl 48, id 21379, offset 0, flags [DF], proto TCP (6), length 60)
    174.194.151.200.10944 > 192.168.1.168.4831: Flags [S], cksum 0xb852 (correct), seq 760232201, win 64240, options [mss 1388,sackOK,TS val 549111670 ecr 0,nop,wscale 7], length 0
02:00:05.656095 IP (tos 0x0, ttl 48, id 38873, offset 0, flags [DF], proto TCP (6), length 60)
    174.194.151.200.10965 > 192.168.1.168.4831: Flags [S], cksum 0xa783 (correct), seq 2401822009, win 64240, options [mss 1388,sackOK,TS val 549112359 ecr 0,nop,wscale 7], length 0
02:00:06.265736 IP (tos 0x0, ttl 48, id 11763, offset 0, flags [DF], proto TCP (6), length 60)
    174.194.151.200.10970 > 192.168.1.168.4831: Flags [S], cksum 0xb262 (correct), seq 4119818640, win 64240, options [mss 1388,sackOK,TS val 549112965 ecr 0,nop,wscale 7], length 0
^C
4 packets captured
4 packets received by filter
0 packets dropped by kernel

and from my laptop's end

ssh juanes@WANIP port 4831
ssh: connect to host WANIP port 4831: Connection refused.

If I repeat the same experiment but with the wifi off, just running on enp2s0, I get

[juanes@juanes ssh]$ sudo tcpdump -lnni enp2s0 port 4831 -vv
tcpdump: listening on enp2s0, link-type EN10MB (Ethernet), capture size 262144 bytes
02:05:24.875120 IP (tos 0x0, ttl 48, id 14546, offset 0, flags [DF], proto TCP (6), length 60)
    174.194.151.200.10956 > 192.168.1.168.4831: Flags [S], cksum 0xbb08 (correct), seq 46235539, win 64240, options [mss 1388,sackOK,TS val 549431476 ecr 0,nop,wscale 7], length 0
^C
1 packet captured
1 packet received by filter
0 packets dropped by kernel

and this time I get a no route to host ssh error from my laptop. Note that throughout all this I still cant access IP4v sites (I cant ping 8.8.8.8, for example.)

seth · 2020-08-21 10:30:44

Also, there is another "Wired connection 1" that starts by default after rebooting

sounds like you're still using networkmanager (in addition)?

99.145.194.62

And it gets you a public AT&T address - you're not receiving this from a local router; or did you configure the router to just forward all traffic to the desktop?
Is this the address your receive from https://ipinfo.io/ip ?

Do you actually open sshd on port 4831 instead of 22?

drcouzelis · 2020-08-21 13:58:13

FYI my Arch Linux computer is configured to use DHCP. My Arch Linux computer is not configured to use a static IP address. Instead, I configured my router to give my Arch Linux computer a static IP address. So the process goes like this...

Arch Linux: "HEEEEY Router! Give me a random DHCP IP address!"
Router: "Hmmm... I know this MAC address that is requesting an IP address... drcouzelis configured me to ALWAYS give this MAC address the same IP address, which is 192.168.0.123."
Arch Linux: "OMG YAY I got an IP address! And it's the same IP address I got last time WHAT A COINCIDENCE!"

...later that day...

Router: "I'm receiving some traffic on Port 22. Now, drcouzelis changed my default configuration which was to ignore this, and to instead send the traffic straight on to 192.168.0.123. So, here you go!"
Arch Linux: "HOLY CRAP Someone is sending me something on Port 22! Hey SSH daemon, I got something for you!!!"

Last edited by drcouzelis (2020-08-21 13:59:19)

imjuanes · 2020-08-21 16:52:44

Hi seth,

seth wrote:

Also, there is another "Wired connection 1" that starts by default after rebooting
sounds like you're still using networkmanager (in addition)?

Yes, correct, I still keep NetworkManager arround because that's how I connect to the wifi when I am looking up stuff into how to fix this. However, turning it off and just having netctl (or NetworkManager) running doesnt do the trick for me. Also something I find interesting is that even though I configured "enp2s0" via netctl, there is still a enp2s0.nmconnection file stored in /etc/NetworkManager/system-connections, which matches what I configured via netctl - is this normal? When I run the following:

[juanes@juanes ssh]$ nmcli connection
NAME                            UUID                                                        TYPE     DEVICE 
Wired connection 1  4901a6f7-4150-3cdd-9c87-9405f08371e3  ethernet  enp2s0 
ATThT7Rfi2             618d133a-bb4e-4ed9-91ce-bc6ae0c0ac51  wifi            --     
enp2s0                    832c3ad6-772d-4c2e-97a4-9cf9d559aced  ethernet     --

you can see that 'Wired connection 1' seems to be associated with the enp2s0 device, while the network I configured via netctl isnt.

seth wrote:

99.145.194.62
And it gets you a public AT&T address - you're not receiving this from a local router; or did you configure the router to just forward all traffic to the desktop?
Is this the address your receive from https://ipinfo.io/ip ?
Do you actually open sshd on port 4831 instead of 22?

Yep, this is the address i receive from ipinfo, I configured the router to forward calls to that port to the ip address of "enp2s0", and in my ssh_config file I have both Port 22 and Port 4831 written in there.

#	$OpenBSD: ssh_config,v 1.34 2019/02/04 02:39:42 dtucker Exp $

# This is the ssh client system-wide configuration file.  See
# ssh_config(5) for more information.  This file provides defaults for
# users, and the values can be changed in per-user configuration files
# or on the command line.

# Configuration data is parsed as follows:
#  1. command line options
#  2. user-specific file
#  3. system-wide file
# Any configuration value is only changed the first time it is set.
# Thus, host-specific definitions should be at the beginning of the
# configuration file, and defaults at the end.

# Site-wide defaults for some commonly used options.  For a comprehensive
# list of available options, their meanings and defaults, please see the
# ssh_config(5) man page.

Port 22
Port 4831 

# Host *
#   ForwardAgent no
#   ForwardX11 no
   PasswordAuthentication yes
#   HostbasedAuthentication no
#   GSSAPIAuthentication no
#   GSSAPIDelegateCredentials no
#   BatchMode no
#   CheckHostIP yes
#   AddressFamily any
#   ConnectTimeout 0
#   StrictHostKeyChecking ask
#   IdentityFile ~/.ssh/id_rsa
#   IdentityFile ~/.ssh/id_dsa
#   IdentityFile ~/.ssh/id_ecdsa
#   IdentityFile ~/.ssh/id_ed25519
#   Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc
#   MACs hmac-md5,hmac-sha1,umac-64@openssh.com
#   EscapeChar ~
#   Tunnel no
#   TunnelDevice any:any
#   PermitLocalCommand no
#   VisualHostKey no
#   ProxyCommand ssh -q -W %h:%p gateway.example.com
#   RekeyLimit 1G 1h

Note, if I have 'Wired connection 1' on, and try to ssh from outside the network (i.e my mobile hotspot) using the ip address from ipinfo it works perfectly. This would is exactly what I need, but the problem is that, if I understand correctly, that IP address is dynamic and it'll change eventually. Some additional piece of information: If I have "enp2s0" on, exclusively, I get 0 from tcdump if I try to ssh from my laptop to either port 22 or port 4831.

[juanes@juanes ssh]$ sudo tcpdump -lnni enp2s0 port 4831 -vv
tcpdump: listening on enp2s0, link-type EN10MB (Ethernet), capture size 262144 bytes
^C
0 packets captured
0 packets received by filter
0 packets dropped by kernel
[juanes@juanes ssh]$ sudo tcpdump -lnni enp2s0 port 22 -vv
tcpdump: listening on enp2s0, link-type EN10MB (Ethernet), capture size 262144 bytes
^C
0 packets captured
0 packets received by filter
0 packets dropped by kernel

However, if I have both enp2s0 and wifi on, I get something if I try to ssh into port 4831 (which is what I would expect I guess?)

[juanes@juanes ssh]$ sudo tcpdump -lnni enp2s0 port 22 -vv
tcpdump: listening on enp2s0, link-type EN10MB (Ethernet), capture size 262144 bytes
^C
0 packets captured
0 packets received by filter
0 packets dropped by kernel
[juanes@juanes ssh]$ sudo tcpdump -lnni enp2s0 port 4831 -vv
tcpdump: listening on enp2s0, link-type EN10MB (Ethernet), capture size 262144 bytes
09:51:58.120788 IP (tos 0x0, ttl 48, id 1732, offset 0, flags [DF], proto TCP (6), length 60)
    174.194.167.32.5224 > 192.168.1.168.4831: Flags [S], cksum 0x09cb (correct), seq 3797299717, win 64240, options [mss 1388,sackOK,TS val 577424715 ecr 0,nop,wscale 7], length 0
^C
1 packet captured
4 packets received by filter
0 packets dropped by kernel

I get a connection refused from my laptop.

Last edited by imjuanes (2020-08-21 16:53:00)

imjuanes · 2020-08-21 18:09:05

Hi drcouzelis,

Thank you for comming back Huh, I see... When I go to configure my router, and I'm on a place called "IP Passthrough", on the Passthrough Mode it gives me the following options:

"Passthrough Mode: The method in which the WAN IP address will be assigned to the selected LAN client.

DHCPS-dynamic: The WAN IP address will be handed out by the device's DHCP server to the first LAN client that requests a DHCP lease. It may be helpful, after the device has obtained a WAN IP address, to cycle the desired LAN client's interface or reboot it. On disabling this feature, you should reboot the LAN client.

DHCPS-fixed: The WAN IP address will be handed out by the device's DHCP server to the LAN client whose MAC address has been specified. It may be helpful, after the device has obtained a WAN IP address, to cycle the LAN client's interface or reboot it. On disabling this feature, you should reboot the LAN client.

Manual: A LAN client must be manually configured with the device's assigned WAN IP address and gateway information."

DHCPS-dynamic kinda sounds like what you're talking about? (Thank you for explaining with the kid story lmao, it definitely helped )

drcouzelis wrote:

FYI my Arch Linux computer is configured to use DHCP. My Arch Linux computer is not configured to use a static IP address. Instead, I configured my router to give my Arch Linux computer a static IP address. So the process goes like this...
Arch Linux: "HEEEEY Router! Give me a random DHCP IP address!"
Router: "Hmmm... I know this MAC address that is requesting an IP address... drcouzelis configured me to ALWAYS give this MAC address the same IP address, which is 192.168.0.123."
Arch Linux: "OMG YAY I got an IP address! And it's the same IP address I got last time WHAT A COINCIDENCE!"
...later that day...
Router: "I'm receiving some traffic on Port 22. Now, drcouzelis changed my default configuration which was to ignore this, and to instead send the traffic straight on to 192.168.0.123. So, here you go!"
Arch Linux: "HOLY CRAP Someone is sending me something on Port 22! Hey SSH daemon, I got something for you!!!"

drcouzelis · 2020-08-22 01:58:59

Nah, I think my setting is DHCPS-fixed. That way you don't have to make any changes on the Arch Linux computer.

Last edited by drcouzelis (2020-08-22 01:59:15)

imjuanes · 2020-08-22 05:26:17

I know seth told me to not be extra on the other post but I must confess I am close to tears - have spend a solid 2 days nonstop on this. I finally managed to get this to work!! Here are the steps I took:

1. I contacted my ISP (ATT) to purchase a small bundle of static IP addresses. (I ended up not doing the port forwarding because the ultimate reasoning behind all this is to set up a server in my house and put some git repos in there that I can access while at school & elsewhere. If my router's IP address is dynamic it'll eventually mess up the git repos, I think?)
2. I set up a new a new ethernet-static profile via netctl, using the following information provided by my ISP: a) one of the usable static IP addresses b) the new static ip of the modem (gateway) c) the DNSs d) the subnet mask.
3. I went the (Home Network)/(subnets & DHCP) and (Home Network)/(IP Allocation) sections of my router's configuration manager to set up the fixed IP addresses as a subnet and allocate the same static IP I set up in step 2 to my device.

I promise I'll secure everything up as you mentioned. Thank you for giving me a networking for dummies lesson on this post and all the other help you provided!

Best wishes, imjuanes

Last edited by imjuanes (2020-08-22 05:27:59)

Pellaeon · 2020-08-22 16:15:16

imjuanes wrote:

1. I contacted my ISP (ATT) to purchase a small bundle of static IP addresses. (I ended up not doing the port forwarding because the ultimate reasoning behind all this is to set up a server in my house and put some git repos in there that I can access while at school & elsewhere. If my router's IP address is dynamic it'll eventually mess up the git repos, I think?)

The address changing shouldn't mess up the repos at all, it'll just make them harder to access as you'll have to be on top of the address as it changes to be able to reach them.

As for buying the static IPs, that wasn't strictly necessary. Dynamic DNS remaps your IP to a completely static domain name as it changes in real time, and then you'd simply port-forward to the servers you need to access from outside.

Arch Linux

#1 2020-08-19 04:15:32

[SOLVED] Cannot SSH into my Arch Desktop from outside the LAN

#2 2020-08-19 04:18:30

Re: [SOLVED] Cannot SSH into my Arch Desktop from outside the LAN

#3 2020-08-19 05:44:09

Re: [SOLVED] Cannot SSH into my Arch Desktop from outside the LAN

#4 2020-08-19 05:47:16

Re: [SOLVED] Cannot SSH into my Arch Desktop from outside the LAN

#5 2020-08-19 12:21:35

Re: [SOLVED] Cannot SSH into my Arch Desktop from outside the LAN

#6 2020-08-19 15:00:33

Re: [SOLVED] Cannot SSH into my Arch Desktop from outside the LAN

#7 2020-08-19 15:03:47

Re: [SOLVED] Cannot SSH into my Arch Desktop from outside the LAN

#8 2020-08-19 15:15:11

Re: [SOLVED] Cannot SSH into my Arch Desktop from outside the LAN

#9 2020-08-19 15:20:51

Re: [SOLVED] Cannot SSH into my Arch Desktop from outside the LAN

#10 2020-08-19 16:16:36

Re: [SOLVED] Cannot SSH into my Arch Desktop from outside the LAN

#11 2020-08-19 16:57:56

Re: [SOLVED] Cannot SSH into my Arch Desktop from outside the LAN

#12 2020-08-19 19:11:33

Re: [SOLVED] Cannot SSH into my Arch Desktop from outside the LAN

#13 2020-08-20 03:46:11

Re: [SOLVED] Cannot SSH into my Arch Desktop from outside the LAN

#14 2020-08-20 06:13:44

Re: [SOLVED] Cannot SSH into my Arch Desktop from outside the LAN

#15 2020-08-20 21:54:22

Re: [SOLVED] Cannot SSH into my Arch Desktop from outside the LAN

#16 2020-08-21 06:08:40

Re: [SOLVED] Cannot SSH into my Arch Desktop from outside the LAN

#17 2020-08-21 08:14:13

Re: [SOLVED] Cannot SSH into my Arch Desktop from outside the LAN

#18 2020-08-21 09:05:19

Re: [SOLVED] Cannot SSH into my Arch Desktop from outside the LAN

#19 2020-08-21 10:30:44

Re: [SOLVED] Cannot SSH into my Arch Desktop from outside the LAN

#20 2020-08-21 13:58:13

Re: [SOLVED] Cannot SSH into my Arch Desktop from outside the LAN

#21 2020-08-21 16:52:44

Re: [SOLVED] Cannot SSH into my Arch Desktop from outside the LAN

#22 2020-08-21 18:09:05

Re: [SOLVED] Cannot SSH into my Arch Desktop from outside the LAN

#23 2020-08-22 01:58:59

Re: [SOLVED] Cannot SSH into my Arch Desktop from outside the LAN

#24 2020-08-22 05:26:17

Re: [SOLVED] Cannot SSH into my Arch Desktop from outside the LAN

#25 2020-08-22 16:15:16

Re: [SOLVED] Cannot SSH into my Arch Desktop from outside the LAN

Board footer