My goal: I want to be able to ssh to my workstation from external client.

My workstation(in the following also referred as server) is on a lan. Its ip address on this lan is obviously different from its ip on the internet. I have set up the ssh server with public keys.

This is what happens when I try to ssh from a client:

  1. If the client is on the same lan:

    I try to ping my server using the ip returned by ifconfig. The client cannot ping my server.

  2. If the client is from outside, not on the lan:

    The client can ping the server, but when I try to connect I get Connection timed out

output of iptables -L -v

Chain INPUT (policy ACCEPT 346K packets, 233M bytes)
 pkts bytes target     prot opt in     out     source               destination         
 346K  233M sshguard   all  --  any    any     anywhere             anywhere            
 346K  233M sshguard   all  --  any    any     anywhere             anywhere            

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 193K packets, 26M bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain sshguard (2 references)
 pkts bytes target     prot opt in     out     source               destination   
  • 1
    Is there any firewall configured on the server which blocks incoming traffic? Please paste the output of iptables -L -v. If you ping your public IP, you usually get a response from the router, not from any host in the LAN behind. – jofel Oct 24 '13 at 9:15
  • As a follow up to @jofel's comment, your router must be configured to NAT incoming connections (from external clients) to your desired server. – Joseph R. Oct 24 '13 at 12:28
  • The firewall on the server seems to be fine. First try to get ping and ssh connections inside your LAN running before you try from outside. Can you connect to ssh from localhost (ssh username@localhost and ssh username@LAN-SERVER-IP on the server)? – jofel Oct 24 '13 at 12:35
  • directly on the server both work (also if in /var/log/auth.log I result to be logged on port 58523 and 39967, respectively -- ssh is listening only on port 11000 and 22 from service ssh status). When I try to log from another client on the lan I get connection timed out – simona Oct 24 '13 at 13:08

Your iptables configuration shows sshguard is being used. I'd check that your sshguard configuration is allowing your ssh connections.

To help troubleshoot, you may want to remove sshguard (sudo apt-get remove sshguard) and confirm that ssh is working normally.

With sshguard installed, check your iptables rules and /etc/hosts.deny rules.

For iptables, try the rules shown in the sshguard netfilter-iptables example:

iptables -N sshguard
# block whatever SSHGuard says be bad ...
iptables -A INPUT -j sshguard
# enable ssh, dns, http, https
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
# and block everything else (default deny)
iptables -P INPUT DROP
| improve this answer | |
  • could you give me some information on how to do that? – simona Oct 25 '13 at 11:29
  • 1
    I've updated my answer with the example sshguard rules shown in the sshguard iptables documentation. – Drew Oct 25 '13 at 12:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.