1

I would like to have access from wan through ssh to my openwrt router. I did the following:

  • Go to the Network / Firewall / Traffic Rules.
  • Scroll down to the “Open ports on router” section.
  • Enter a name for this rule, e.g. “Allow-SSH-WAN”.
  • Set “Protocol” to “TCP”.
  • Enter “22” as the “External Port”.
  • Click “Add”.
  • Click “Save and Apply”.

Unfortunately ssh root@myWANip does not answer. What did I miss?

  • from inside the routers NAT? Not supported (I think it's possible if you get fancy with iptables rules, but my OpenWrt CC doesn't implement it). – sourcejedi May 15 '17 at 7:27
  • i am looking for ssh from a different network to my openwrt through the WAN. not inside the routers NAT. – john May 15 '17 at 13:09
  • ok. client is Linux? you should try running sudo traceroute -T -p 22 myWANip. It might show whether there is another nasty firewall in the way or you have a clear path right up to the router using port 22. – sourcejedi May 15 '17 at 14:39
  • also, it would be clearer if you give a specific on "does not answer". I assume you get "connection refused". If instead it just hangs, I'd want to look at ssh -v or so to confirm where the hang happens. – sourcejedi May 15 '17 at 14:43
0

I ran into this issue and in my case it was down to the fact that the default config on Openwrt has its LAN network interface network set to 192.168.1.X and if your local network also uses this address range then you can't talk to the router when you're plugged into the WAN interface. This is because the Openwrt box tries to send the packets back on its LAN interface when you're plugged into the WAN interface (also with a 192.168.1.X address), as the box thinks the LAN interface is the best one for sending packets to 192.168.1.X.

The way to fix it is to change IP network address (in LuCI: Network->Interfaces->LAN->Edit->IPv4 Address) assigned to the LAN interface so it's different from your local network address (e.g. use 192.168.0.X, 10.0.0.X) and then should be able to connect to ssh over the WAN interface - given you've done the Firewall setup you mentioned.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.