Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

This is an extension to ssh port forward to access my home machine from anywhere

I tried things mentioned there but I am not able to ssh to my machine.

Netgear router settings for port forwarding:

Start Port: 22
End Port: 22
Server IP Address: IP address of by FreeBSD box

/etc/ssh/sshd_conf of my FreeBSD box:

PasswordAuthentication yes
AllowUsers root
X11Forwarding yes
AllowTcpForwarding yes

How I am trying to connect:

I've signed up for dyndns.com and got a URL that maps to my external IP address.

From another machine in my home network, I do: ssh -l root my_dyndns_ip Which is just timing out.

On the other hand, I can ping my_dyndns_url successfully.

Debugging:

How can I fix this so that I can ssh from anywhere to my_dnydns_url ?

I tried to look into logs of my Netgear router but on failed ssh attempt, no log in generated on the router.

I also looked into /var/log/messages but could not finding anything.

Edit:0 Running ssh in verbose mode (as per @jasonwryan suggested):

I am noticing a weird thing: When I do ssh to the dyndns.com provided url, its trying to connect to other IP address than what I get from whatismyip.com. Isn't that wrong?

Edit:1 Problem with dyndns is now solved.

Now when I try to ssh, it times out and I get error: Connection timed out

Edit:2 Does iptables or NAT has anything to do with it?

Edit:3 I started ssh with -d option to capture debug messages.

When I ssh to the freebsd box from any other machine in wlan, It works fine and I can see logs.

But when I ssh to external ip (which should forward that to my freebsd box), I do not even see any logs - that means, request is not even reaching freebsd box. And it times out.

share|improve this question
2  
Run SSH in verbose mode to generate some meaningful error messages: ssh -vvv ... –  jasonwryan Sep 4 '11 at 4:45
    
thanks a lot @jasonwryan, I updated with Edit:0 –  hari Sep 4 '11 at 5:20
    
Routers can be buggy. When they are buggy they are a nightmare. What is the brand of your router and are you using the original firmware? If possible I suggest trying with a router which has (for example) Tomato installed. Tomato is not perfect, but is a long way better than the proprietary router firmwares. Note: I'm not suggesting this is the source of your problem, but I've found buggy routers can greatly complicate things. –  Faheem Mitha Sep 4 '11 at 8:21
    
I think your use of the term URL above is incorrect. You mean a Fully Qualified Domain Name (FQDN) I assume. What does host my_dyndns_ip show? –  Faheem Mitha Sep 4 '11 at 8:24
    
Thanks @Faheem Mitha. I've netgear WPN824v3. How can I make sure if its buggy? And what is Tomato? :) –  hari Sep 4 '11 at 8:24
show 19 more comments

4 Answers

I am thinking you problem is not in the port forwarding, but another option in the NAT config in the router.

First, ensure if you use your LAN IP, you can successfully SSH from another machine on the network. This ensures SSH works at all.

Second, test from another machine outside the network using the public IP. This ensures that port forwarding works.

Third, test from that same machine outside the network and use the DynDNS URL. This ensures that DynDNS is working properly.

If all of those succeed, then nothing is wrong with your configuration (which I'll assume is correct) and you problem is only accessng the public IP (either directly or through DynDNS) from inside the network. This means that your router needs to have NAT reflection enabled (if possible) to route internal requests as if they were external requests for the public IP.

share|improve this answer
    
Thanks. As I've described, 2nd and 3rd test fails. –  hari Sep 5 '11 at 3:28
    
Can you setup something to listen for port 22 on another machine and change the port forward rule to point towards the second machine? You need to rule out whether it is something in the router or something on the machine that is blocking it. –  MaQleod Sep 5 '11 at 19:18
add comment

Is your sshd server listening on port 22, try adding:

Port 22

to your config.

If that doesn't work try forwarding a port above 1024 (Some ISP's don't allow non business subscriber traffic on ports below 1024). Also make sure if you do this you change the line in the conf I just told you about to reflect the same value.

share|improve this answer
    
Thanks @Mike. I just encountered an interesting issue that I logged as Edit:0 –  hari Sep 4 '11 at 5:24
    
I changed the port to > 1024. I tried sshing to the IP address I get from whatismyip.com (my external ip) but my connection is timing out. Getting error: "Connection timed out" –  hari Sep 4 '11 at 5:30
add comment

try to change ssh port to 443 - if you will be able to connect to this port, so there is a proxy between client and your home PC

log all dropped and forwarded packets in your firewall it can allow you to find incorrect forwarding rules

try to scan you external IP with nmap (or another tool) (ports <1024) - firewall logging should show dropped connections and on client side you should see opened ports

make traceroute to you home PC from client - is there any unexpected hosts between, are these hosts forward ports correctly?

share|improve this answer
add comment

Try with tcptraceroute to debug if you can go to the remote port first. If some machine is blocking the port you can see in the output. Try to use netstat -atun the see the open ports/connections on both machines.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.