1

I am trying to troubleshoot why I can't connect to a remote SFTP from a Unix machine. The remote host has my public key, and my firewall is configured to allow the outbound connection to the host.

I've checked if the host is up, using nmap -Pn -p 22 $HOST and I get this result:

Host is up.
rDNS record for $HOST
PORT   STATE    SERVICE
22/tcp filtered ssh

I've tried to connect to it through the command line, and every time the connection times out. I can see the outbound connection going through, but there is no response.

Here's how I try to connect through the command line:

timeout 30 ssh -i ~/.ssh/my_private_key user@$HOST

I've tried copy/pasting the private key over to a plain text file as well and using that:

timeout 30 ssh -i ~/.ssh/my_private_key.txt user@$HOST

$ ssh -vvv -i ~/.ssh/my_private_key user@$HOST
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 58: Applying options for *
debug2: resolving "$HOST" port 22
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to $HOST [$HOST] port 22.
debug1: connect to address $HOST port 22: Connection timed out
ssh: connect to host $HOST port 22: Connection timed out

Is there anything else I should be doing to troubleshoot the connection on my end before accusing the host of doing something wrong?

3
  • 1
    The nmap filtered tells you that nmap can not get to the host port 22, so it is no surprise that ssh can't get to port 22 either. How far away in network hops are your 2 machines? You could use something like tcptraceroute to see if you can find an intermediate machine that is blocking port 22.
    – icarus
    Feb 7, 2020 at 19:54
  • Your nmap command tells you port 22 is filtered which means something is blocking that port. You mentioned you have configured the firewall to allow the outbound connection, did you configure the SSH host firewall to allow inbound connections to that port? Feb 7, 2020 at 20:13
  • @GracefulRestart I do not own the host SFTP. My suspicion was that it was blocking my connection, but I wanted to do my due diligence and make sure the issue wasn't on my end before I pointing a finger at the host. Feb 7, 2020 at 21:33

1 Answer 1

1

You need to configure the client to allow NEW outbound as you have but also to allow inbound on that same port for already ESTABLISHED connections. On the Host you need to allow inbound NEW connections on that port and outbound on that same port for already ESTABLISHED connections.

Example:

(This will allow incoming SSH connections suitable for the Host)

sudo iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

sudo iptables -A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT

(This will allow outgoing SSH connections suitable for the Client)

sudo iptables -A OUTPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

sudo iptables -A INPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .