When I attempt a SSH connection between client C and server S (both on the same LAN) the client looks up the server's key in the client user's known_hosts file.

In the usual case for connection attempts, if the server's key is not found, the client is prompted to accept the server's key into the user's known_hosts file . If the key is found then the connection process continues.

However I have a situation where if the connection request is forwarded through the LAN router/modem the lookup for the server's key fails even though the target server's key is there, and the client is not prompted. Instead the attempt is refused with Connection reset by <IP of router>

Connect success to the LAN host directly using :

ssh -vvv stephen@acer 

Connect failing to the LAN router to forward to acer using:

ssh -vvv stephen@michigan

This has just started happening. Any idea why?

  • Is the server key altered by the router?

  • Is the router replacing the target server's key with its own?

  • Is there some way of getting a look at the key that's being passed. I am calling with ssh -vvv have the SSH logging set to VERBOSE but see nothing I recognize as useful

System info:

Server host Ubuntu 18.04: Openssh-server/bionic-updates,bionic-security,now 1:7.6p1-4ubuntu0.1 amd64    
Tested with clients:  

- Ubuntu 18.10: openssh-client/cosmic,now 1:7.7p1-4 amd64  
- Ubuntu 18.04: openssh-client/bionic-updates,bionic-security,now 1:7.6p1-4ubuntu0.1 amd64 
- Debian 9.5: openssh-client/stable,now 1:7.4p1-10+deb9u4 amd64

 Modem: Arris Xb6

Update to: SSH forwarded through modem recently started failing: update

  • What does the ssh command you are passing look like? – Michael Prokopec Nov 24 '18 at 21:04
  • @MichaelProkopec I have added the commands to the question. Thank you. – Stephen Boston Nov 24 '18 at 23:40
  • You say forwarding to acer, are you saying that you are outside the LAN at that point. – Michael Prokopec Nov 24 '18 at 23:48
  • @MichaelProkopec No For both those requests, I am inside the LAN on another host i.e. a host other than acer (hostname vaio). I don't think this is a loopback problem because I can access other services on acer in this way. SSH is the only service that has given me connection problems this far. – Stephen Boston Nov 25 '18 at 0:02
  • 1
    Check out rui's post: serverfault.com/questions/210408/… – Michael Prokopec Nov 25 '18 at 0:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.