I recently reinstalled OpenWRT after I mistook a bug with cookies that caused a logon loop, for a forced entry into my router.

Model TP-Link TL-WR841N/ND v8 Firmware Version OpenWrt Chaos Calmer 15.05.1 / LuCI 15.05-149-g0d8bbd2 Release (git-15.363.78009-956be55)

Seemingly as a result, I cannot now access a machine in my LAN from the WAN. I CAN access the same machine from the same laptop, when it's on my LAN (it's set-up with the target machine's ssh cert, so logs straight in) but it times out when I try to access it from outside my LAN.

My Open WRT port forward:

TargetMachineSSH IPv4-TCP, UDP From any host in wan Via any router IP at port xxxx IP, port 22 in lan

To test external access I ssh'd into an Ubuntu virtual server at work, via work's VPN and from there ssh'd back to my home desktop machine, using external port xxxx, which failed/timed out. I used ssh -l user -p xxxx mys.tat.ici.p <= (my static IP)

As well as setting up a port forward, do I need a firewall rule for ssh? How would this look, given that I want to have a different external port for each of my machines and use port forwarding rules to resolve these to a machine's IP on port 22?

Something I know nothing about but which gets mentioned elsewhere is NAT - is this relevant and what should I check if it is?

  • what do you get if you use the -v option or -vv etc... for ssh to see some debugging messages. – Jeff H. Apr 26 '18 at 23:17
  • I just tried ssh from my work's virtual server again but with -v and then -vv. Neither revealed anything interesting (here are the last 3 of 6 lines ): debug1: Connecting to <static IP> [<static IP>] port xxxx. debug1: Connect to address <static IP> port xxxx: Connection timed out ssh: Connect to address <static IP> port xxxx: Connection timed out – Greg Apr 27 '18 at 10:53
  • I have also tried to interpret the firewall status page in LuCI (having reset the stats) but I'm not sure what to look for on the receiving end of the WAN side ssh port forward request. – Greg Apr 27 '18 at 13:01
  • Running service sshd status showed the successful login from within the LAN Apr 27 14:41:44 <TARGET HOSTNAME> sshd[5025]: Accepted publickey for <USER> from port 54973 ssh2: RSA SHA256: <CERT> Apr 27 14:41:44 <TARGET HOSTNAME> sshd[5025]: pam_unix(sshd:session): session opened for user <USER> by (uid=0) but nothing shows when access attempted from WAN on same machine. Does that imply firewall is the culprit? – Greg Apr 27 '18 at 14:01
  • Are you logging in to ssh with a password or a key? – Jeff H. Apr 28 '18 at 15:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.