1

I have set up a no-ip account to access my ssh server at home remotely with myserver.ddns.net, which works well.. from outside only.

From outside:

Remote ping:

$ ping myserver.ddns.net # success

Remote ssh:

$ ssh myserver.ddns.net # success

From local:

Local ping:

$ ping 192.168.2.8 # success

Local ssh:

$ ssh 192.168.2.8 # success

Remote ping:

$ ping myserver.ddns.net # success, resolving to 90.113.108.192

Remote ssh:

$ ssh myserver.ddns.net # loOong time waiting, then..
Connection closed by 90.113.108.192 port 22

Why could it be so?

  • You haven't set portforwarding on your router from local addresses, only from externals. – Ipor Sircer Feb 18 '17 at 22:37
  • Firewall rules, routes....not enough data from your post. – Rui F Ribeiro Feb 18 '17 at 23:01
  • @RuiFRibeiro Question edited to add more info. Is this enough? – iago-lito Feb 18 '17 at 23:27
  • 1
    Many routers don't allow LAN addresses to loop back to the WAN address. I ran into that problem and set up a DNS server on the intranet as a workaround. I'd be interested in an alternate solution. – Fox Feb 18 '17 at 23:35
  • 1
    The SSH server could be used as a DNS server, yes. For your whole network even. I use BIND9. It's under 2 MB of files including configuration and the executables. top says it's using 0.0% CPU and ~60MB RAM. Arch has a tutorial that might be useful. – Fox Feb 18 '17 at 23:59
1

The answer about accessing NAT from an internal network is, more correctly: you do not want to do that because of:

  • restrictions of consumer-grade technology;
  • performance reasons - NAT uses more CPU resources and memory - albeit in a domestic scale it is not worrisome;
  • routing more complex - either using and debbuging.

The alternatives are:

  • if accessing only from that local server, creating an host file entry;
  • creating a name server, and creating views if a public DNS name that belongs to you - not the case you present, but usually in an enterprise;
  • creating a name server, and creating a custom internal name, like ssh.home;
  • using BIND+RPZ, and redefining the external name to your internal IP address;
  • if doing routing with a Linux box, with iptables+NAT, capturing the SSH sessions to your external IP, and NATing them to your internal IP address.

About my comments about capturing the IP address/creating the host file, see this answer how I deal at home with my DDNS address. Better method for acting on IP address change from the ISP?

For BIND+RPZ see:

Configure BIND as Forwarder only (no root hints), encrypted + RPZ blacklist / whitelist all together

Large zone file for bind9 : ad-blocking

0

Okay, from the comments and this page, I understand that it is a common security feature for routers not to accept such "NAT loopbacks": i.e. connecting from a local machine to another local machine via an external domain resolution.

As workarounds, I have been suggested to:

  • use a custom image like openwrt or ddwrt in place of my native router softwares. (cheers to Ipor Sircer)
  • set up a local DNS server (cheers to Fox)

Feel free to offer any other item I could append to this list :)

  • The problem is not the domain resolution, but routing/port forwarding or NAT only working from the outside. – Rui F Ribeiro Feb 19 '17 at 8:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.