Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I made a dedicated Samba file server on my Debian(3.2) machine. I have had great success accessing it from both Windows and Unix. I can SSH into it on the local network.

When I try to SSH into it via the public IP address, it says connection refused.

I would like to be able to ssh into it remotely, directing into the Samba share. How would I go about doing this? I hear I might have to port forward? Do I need to change anything in the smb.conf file?

Here's my sshd_config file:

# Package generated configuration file
# See the sshd_config(5) manpage for details

# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 768

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
PermitRootLogin yes
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile %h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
share|improve this question
Most likely your filewall is blocking the incoming connection. Is your server on a private LAN? Do you have a firewall? Are you using NAT? What router do you have? – Keith Nov 10 '12 at 5:54
What is a private LAN? Ya I have a firewall(as far as I can tell). I don't know what NAT is, and my router is a trendnet TEW-632BRP. – Scriptonaut Nov 10 '12 at 6:00
What's the IP address of your server? PS. you can remove the rather long config file, we don't need it. – Keith Nov 10 '12 at 6:00
Why is my IP address necessary(Sorry I'm paranoid, I posted on hear a few months ago and some guy got control of my machine and destroyed it). – Scriptonaut Nov 10 '12 at 6:03
Just to tell if it's private or not. Also, are you getting an dynamic IP from your ISP, or static? – Keith Nov 10 '12 at 6:07
up vote 5 down vote accepted

Scriptonaut, probably your problem has nothing to do with Samba, but has to do with port forwarding/NAT. If you have your SAMBA serving Debian computer in a LAN network, behind a router, you need it configured to transfer requests to some of its ports to your SAMBA running machine:

enter image description here

First, I'll tell, how outgoing connections work with router. When 2 machines speak via TCP/IP each machine (source machine and destination machine) is addressed with a pair IP/port number, so the connection is determined by 2 pairs: source IP/port number and destination IP/port number.

When you open a tab in Mozilla and access Google on your machine, it transfers some IP packets to the Router with source address of itself IP= and arbitrary outgoing TCP port number it allocated for that tab of browser (like 43694) and asks the router to transfer that packets to Google machine with certain IP on 80 port of that machine, cause 80 is standard port for incoming http connections (you can see the list of standard TCP ports in /etc/services file on Linux). Router allocates a port of its own at random (e.g.12345), replaces source IP/port pair in that packets with its own WAN IP ( and port 12345 and remembers, that if it gets response on port 12345 from Google, it should automatically transfer that response back to, port 43694.

Now, what happens when an outer machine wants to access your server?

When you try to access your SAMBA server from the outer machine, it sends IP packets to your WAN IP=, port 22 of it (because, 22 is a standard TCP port for listening to SSH connections, you can see the list of standard TCP ports in /etc/services file on Linux). Your Router receives that packets. By default, firewalls on routers are configured to block all incoming connections to any port, if there was no outgoing connection, bound to that port (so, when you were accessing Google in previous case, router didn't block response from Google to port 12345 of itself, cause it remembered that your initiated connection to Google and response from google should come to port 12345). But it would block attempts to initiate connections from the outer world to port 22 of it, cause port 22 was not mapped for any connections incoming from LAN.

So, what you need to do is to configure your router to transfer all the connections to its port 22 from the outside to port 22 of your This can be done in web-interfaces of hardware routers, usually the menu option you need is called "Port-forwarding" or "NAT - network address translation".

share|improve this answer
Alright, so I forwarded port 22, and put as the address for the LAN server. This is the private IP address of the Samba machine. Now when I try to ssh remotely it times out, rather than saying connection refused for some reason. – Scriptonaut Nov 10 '12 at 23:00
Hey, so I just read that it's possible that my ISB(comcast) blocks port 22. Would changing it to a different port be possible? How hard would it be to ssh on a different port(especially for programs like CVS and stuff)? – Scriptonaut Nov 10 '12 at 23:20
This may help, but i must say, that I don't understand why comcast blocks port 22. – Bonsi Scott Nov 11 '12 at 9:42
Quite often Internet Service Providers block ports 80 and 8080, so that if computer illiterate users run their routers off the box without setting admin password, they don't have hackers immediately high-jacking their routers (although, I don't understand, why would router at all process any connections to its WAN IP's 80th port; IMO, it makes sense to show admin page on 80th port of LAN IP only and any access to 80th of WAN should be either forwarded or blocked). But I never heard of blocking 22 port. My ISP blocks 80 and 8080, but doesn't touch 22. – Bob Nov 11 '12 at 15:50
Hm, I'm also not sure that LAN IP is ok. Cause, typically LANs nowadays have /24 bit mask, which means that if your router's LAN IP is you can access only 192.168.1.* machines, not 192.168.10.*. As for time out: may be you could run tcpdump on port 22 of your SAMBA server to check, whether it receives the packets at all. If it does - probably sshd is misconfigured, else - problems with port forwarding. There are good examples in man tcpdump just in case. – Bob Nov 11 '12 at 16:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.