Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #171910 > unrolled thread

SSH Connection Behind A Router/Firewall

Back to article view | Back to linux.debian.user

Contents

  SSH Connection Behind A Router/Firewall Tim McDonough <tmcdonough@gmail.com> - 2016-09-08 20:00 +0200
    Re: SSH Connection Behind A Router/Firewall Joe <joe@jretrading.com> - 2016-09-08 20:50 +0200
      Re: SSH Connection Behind A Router/Firewall Tim McDonough <tmcdonough@gmail.com> - 2016-09-09 01:50 +0200
    Re: SSH Connection Behind A Router/Firewall Arun Khan <knura9@gmail.com> - 2016-09-12 06:40 +0200

#171910 — SSH Connection Behind A Router/Firewall

I have a very straightforward Debian Jessie machine on my network. For 
SSH it uses the standard/default Port 22 and accessing it via ssh works 
just fine from anywhere on the local network.

I also have a NetGear router configured so that a connection from the 
outside world using Port 1024 gets forwarded to the local IP and Port 22 
on the LAN. My problem is when I attempt a connection from the outside 
world the connection is refused.

Is there another setting on the Debian Jessie system I need to configure 
or do you believe this is a router configuration problem? If I just 
allow the forwarding (externally) to forward on Port 22 things work as 
expected.

Thanks,

Tim

[toc] | [next] | [standalone]

#171911

On Thu, 8 Sep 2016 12:49:56 -0500
Tim McDonough <tmcdonough@gmail.com> wrote:

> I have a very straightforward Debian Jessie machine on my network.
> For SSH it uses the standard/default Port 22 and accessing it via ssh
> works just fine from anywhere on the local network.
> 
> I also have a NetGear router configured so that a connection from the 
> outside world using Port 1024 gets forwarded to the local IP and Port
> 22 on the LAN. My problem is when I attempt a connection from the
> outside world the connection is refused.
> 
> Is there another setting on the Debian Jessie system I need to
> configure or do you believe this is a router configuration problem?
> If I just allow the forwarding (externally) to forward on Port 22
> things work as expected.
> 

No, that should work. As far as the server is concerned, it's a
standard port 22 job.

If a router has the option of setting the destination port in a
forwarding rule, that really ought to work. I've done it in two stages,
forwarding port A on the public IP, to port B on my firewall/server,
then to port 22 on an internal machine, no trouble.

Sorry to ask this, but... your ssh client does know it's using 1024,
doesn't it? Not just the software client, but is there an outgoing
firewall that also needs to know this? On a modern Windows machine, you
need to explicitly set up an outgoing rule, it's not just a simple
stateful firewall any more.

Quick check from your network: use Shields Up!! on https://grc.com and
ask for a check on your specific external port. If the router isn't
forwarding, or the server isn't responding, the port will show as
closed. If it shows open, and Mr Gibson lectures you about security,
then you have a problem at the client end.

-- 
Joe

[toc] | [prev] | [next] | [standalone]

#171928

On 9/8/2016 1:42 PM, Joe wrote:
> On Thu, 8 Sep 2016 12:49:56 -0500
> Tim McDonough <tmcdonough@gmail.com> wrote:
>
>> I have a very straightforward Debian Jessie machine on my network.
>> For SSH it uses the standard/default Port 22 and accessing it via ssh
>> works just fine from anywhere on the local network.
>>
>> I also have a NetGear router configured so that a connection from the
>> outside world using Port 1024 gets forwarded to the local IP and Port
>> 22 on the LAN. My problem is when I attempt a connection from the
>> outside world the connection is refused.
>>
>> Is there another setting on the Debian Jessie system I need to
>> configure or do you believe this is a router configuration problem?
>> If I just allow the forwarding (externally) to forward on Port 22
>> things work as expected.
>>
> No, that should work. As far as the server is concerned, it's a
> standard port 22 job.
That was my thought as well.
> If a router has the option of setting the destination port in a
> forwarding rule, that really ought to work. I've done it in two stages,
> forwarding port A on the public IP, to port B on my firewall/server,
> then to port 22 on an internal machine, no trouble.
I have a NetGear WNDR3800. I have the port forwarding setup as you 
describe.
> Sorry to ask this, but... your ssh client does know it's using 1024,
> doesn't it? Not just the software client, but is there an outgoing
> firewall that also needs to know this? On a modern Windows machine, you
> need to explicitly set up an outgoing rule, it's not just a simple
> stateful firewall any more.
Don't apologize for asking, I'd be perfectly happy if I'd overlooked 
something simple. I'm using a Windows 10 machine to access it and even 
with the firewall in the Win10 box turned off I get the same results.
> Quick check from your network: use Shields Up!! on https://grc.com and
> ask for a check on your specific external port. If the router isn't
> forwarding, or the server isn't responding, the port will show as
> closed. If it shows open, and Mr Gibson lectures you about security,
> then you have a problem at the client end.
The port shows as open.

I initially used PuTTY to test and when I first got the error I also 
tried making an sftp connection with Filezilla. A forwarded port is a 
no-go with either of them.

Thanks for the suggestions,

Tim

[toc] | [prev] | [next] | [standalone]

#172075

On Thu, Sep 8, 2016 at 10:49 AM, Tim McDonough <tmcdonough@gmail.com> wrote:
> I have a very straightforward Debian Jessie machine on my network. For SSH
> it uses the standard/default Port 22 and accessing it via ssh works just
> fine from anywhere on the local network.
>
> I also have a NetGear router configured so that a connection from the
> outside world using Port 1024 gets forwarded to the local IP and Port 22 on
> the LAN. My problem is when I attempt a connection from the outside world
> the connection is refused.

Presuming the ssh "client" is on the WAN, have you set the
"destination" port to 1024 in that client?
For example in *nix box, it would be "ssh -p 1024 someuser@your_wan_pub_ip"

-- Arun Khan

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web