Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm using RHEL4 and RHEL5.

A new group of Linux machines are setup recently using 172.16.32.0/24. The existing RHEL machines are running on 172.16.1.0/22 and 172.16.4.0/22. When I try to ssh from 172.16.4.39 to 172.16.1.1, there's no problem.

> traceroute 172.16.1.156
traceroute to 172.16.1.156 (172.16.1.156), 30 hops max, 46 byte packets
 1  swt0 (172.16.4.240)  1.396 ms  1.380 ms  1.758 ms
 2  172.16.1.156 (172.16.1.156)  579.076 ms  573.315 ms  574.878 ms

If I ssh to any one of the new machine, I get ssh timeout, although I can traceroute to it.

> traceroute 172.16.32.11
traceroute to 172.16.32.11 (172.16.32.11), 30 hops max, 46 byte packets
 1  swt0 (172.16.4.240)  5.968 ms  1.641 ms  1.476 ms
 2  * * *     <----- could be misconfiguration, not sure how to troubleshoot this.
 3  172.16.32.11 (172.16.32.11)  273.330 ms  271.820 ms  274.223 ms

> ssh -v -v -v 172.16.32.11
OpenSSH_3.9p1, OpenSSL 0.9.7a Feb 19 2003
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to 172.16.32.11 [172.16.32.11] port 22.
debug1: connect to address 172.16.32.11 port 22: Connection timed out
ssh: connect to host 172.16.32.11 port 22: Connection timed out

I added a similar route on both the switch (swt0) and firewall to point 172.16.32.0/24 to the same gateway 172.16.5.253. Also added a new line in hosts.allow file on 172.16.4.39 (the machine where I try to ssh from).

> cat /etc/hosts.allow
ALL: 127.0.
ALL: 172.16.0.0/255.255.252.0
ALL: 172.16.4.0/255.255.252.0
ALL: 172.16.24.0/255.255.252.0
ALL: 172.16.32.0/255.255.255.0

Any advice what other files I should check/change to make ssh work between 172.16.4.0/22 172.16.32.0/24?

Output of ping and route -n:

> route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
172.16.4.0      0.0.0.0         255.255.255.0   U     0      0        0 eth0
0.0.0.0         172.16.4.240    0.0.0.0         UG    0      0        0 eth0

> ping 172.16.32.11
PING 172.16.32.11 (172.16.32.11) 56(84) bytes of data.
64 bytes from 172.16.32.11: icmp_seq=0 ttl=62 time=269 ms
64 bytes from 172.16.32.11: icmp_seq=1 ttl=62 time=259 ms
64 bytes from 172.16.32.11: icmp_seq=2 ttl=62 time=269 ms
64 bytes from 172.16.32.11: icmp_seq=3 ttl=62 time=268 ms

--- 172.16.32.11 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
rtt min/avg/max/mdev = 259.331/266.884/269.777/4.408 ms, pipe 2
share|improve this question
    
are you able to ping that network.......????? –  P4cK3tHuNt3R Feb 19 '13 at 5:48
    
Yes I can ping it. –  user11496 Feb 19 '13 at 6:23
1  
You threw in an extra IP address for a router. Your network topology info does not appear to be complete. Show the "route -n" output from BOTH machines (identifying which is which) being tested, and confirm the IP addresses of the router between these machines. Then check iptables on both machines, and any access rules in the router. –  Skaperen Feb 19 '13 at 6:37
    
In your last route output the network 172.16.4.0 has the wrong netmask. I wonder why you're playing with netmasks like 255.255.252.0. There are 16 networks from 172.16.* to 172.31.*. If that's not enough, check out 10.*. –  ott-- Sep 14 '13 at 21:49

1 Answer 1

Is it possible that the router between the two networks has a firewall that limits which ports you can reach? It is possible that the firewall allows you to send ICMP packets (ping), but not ssh packets. Try to do a port scan of 172.16.32.11:

nmap 172.16.32.11

It should show you which ports it can reach, and which ones are blocked by a firewall ("filtered").

> ping 172.16.32.11
PING 172.16.32.11 (172.16.32.11) 56(84) bytes of data.
64 bytes from 172.16.32.11: icmp_seq=0 ttl=62 time=269 ms

Hmm, what's up with those latencies? Are the network connected with a slow link, or is this a possible symptom of another problem? In a LAN you should get latencies <1ms.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.