Why does sshd accept local network inbound connections and refuse external inbound connection?

Question

When I try to connect to my server from the internet, I always get:

debug2: ssh_connect: needpriv 0
debug1: connect to address XX.XX.XX.69 port 22: Connection refused
ssh: connect to host XX.XX.XX.69 port 22: Connection refused

But from the local area network with 192.168.... all works fine.

Why this difference?

Note I tested with telnet XX.XX.XX.69. Port 22 is open.

Answer 1

“Connection refused” indicates that there is a firewall preventing connections or that there is no server listening on that port on the target host. A few possible reasons why your telnet attempt would have worked but not your ssh attempt:

• The SSH daemon was not running when you tried with ssh.
• You didn't try telnet and ssh from the same machine, and SSH connections are accepted from the machine you ran ssh on but not from the machine you ran telnet.
• The SSH server requires port knocking. The telnet attempt happened soon enough after the port knocking, but the knock's validity had expired when you tried ssh.
• The IP address of the server is dynamic and was assigned to another machine at the time.
• Something about the network configuration changed between your attempts. Most likely on your router, but possibly on your client machine, on the server or any place in between. It's difficult to speculate without having more information about your network setup.