Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I tried to use set up git and use it for github, then when I followed the help doc, but when I got to step 5 of the set up ssh keys section :Test everything out , When I used this command: ssh -T git@github.com I got an error:

ssh: connect to host github.com port 22: No route to host

Then I used this command:

ssh -vT git@github.com

Here is what I got:

OpenSSH_5.8p1 Debian-7ubuntu1, OpenSSL 1.0.0e 6 Sep 2011
debug1: Reading configuration data /home/jacos/.ssh/config
debug1: Applying options for github.com
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to github.com [207.97.227.239] port 22.
debug1: connect to address 207.97.227.239 port 22: No route to host
ssh: connect to host github.com port 22: No route to host

I googled for a while and found I have to check if the iptables blocked the port. So here is the result:

~$ sudo /sbin/iptables -L -n
[sudo] password for jacos: 
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:67 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:67 
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:53 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:53 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  0.0.0.0/0            10.42.43.0/24       state RELATED,ESTABLISHED 
ACCEPT     all  --  10.42.43.0/24        0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-port-unreachable 
REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-port-unreachable 
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

And I tried the command suggested by Gilles:

tcptraceroute github.com 22

Here is what I got:

Selected device eth0, address 222.20.58.XX(sorry...I masked part of my ip), port 33281 for outgoing packets
Tracing the path to github.com (207.97.227.239) on TCP port 22 (ssh), 30 hops max
 1  222.20.58.254  0.891 ms  0.850 ms  0.693 ms
 2  zxq-xs-h3c7510e.hust.edu.cn (115.156.255.137)  1.253 ms  1.569 ms  2.837 ms
 3  zxq-xs-rjs8606.hust.edu.cn (115.156.255.130)  0.729 ms  0.678 ms  0.629 ms
 4  115.156.255.174  0.794 ms  6.279 ms  16.569 ms
 5  * * *
 6  * * *
 7  * * *
 8  * * *
 9  * * *
10  * * *
11  * * *
12  * * *
13  * * *
14  * * *
15  * * *
16  * * *
17  * * *
18  * * *
19  * * *
20  * * *
21  * * *
22  * * *
23  * * *
24  * * *
25  * * *
26  * * *
27  * * *
28  * * *
29  * * *
30  * * *
Destination not reached

It seems that the route is stopped at 115.156.255.174, which I don't know where it is.

I can't figure out what it means. Does it block port 22?

By the way, I can access the Internet and visit github.com. And I am using Ubuntu 11.10.

Can anyone help with this? Thanks!

share|improve this question
    
Do you connect to the internet through a proxy server? –  jackweirdy May 13 '12 at 14:45
    
@jackweirdy No, I am a student using the network at my school. Is it possible that the port 22 is blocked by my school? –  Gnijuohz May 13 '12 at 15:13

2 Answers 2

up vote 2 down vote accepted

Your INPUT chain accepts everything. You haven't shown your OUTPUT chain, but I'll assume that it accepts everything too. This implies that the connection is blocked somewhere between you and Github. It is possible that your school's firewall blocks outgoing connections to port 22.

You can get a better idea of where your packets are intercepted by installing tcptraceroute Install tcptraceroute and running tcptraceroute github.com 22.

Ask your school's administrator to open port 22, or at least (if they're reluctant) port 22 to github.com. Your use of the network is a serious use, which should be allowed to students.

If the administrators do not budge, and you use a proxy to connect to the web, you might be able to get the proxy to relay traffic (it may or may not work, depending on how the proxy is configured). See Is it possible to SSH through port 80?

By the way, your INPUT chain allows all incoming traffic, since you only have ACCEPT rules and an ACCEPT policy. A typical rule set would block incoming UDP traffic on non-vetted ports and block incoming TCP connections on non-vetted ports:

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j ACCEPT
iptables -A INPUT -p udp --dport 123 -j ACCEPT
iptables -P INPUT DROP
share|improve this answer
    
I ran that command again and found that as I have updated in my question there was nothing in the output chain. Does that mean I accept everything? –  Gnijuohz May 14 '12 at 23:45
    
@Gnijuohz Yes, since you only have ACCEPT rules and your policy is ACCEPT, your machine allows all incoming and outgoing traffic. You also forward everything, unless there's a restriction on the third FORWARD rule (e.g. to a particular interface — you need to add the -v flag to iptables to see all the parts of a rule). –  Gilles May 14 '12 at 23:53
    
Thanks, I used the command you gave and I got the response, it seemed it's blocked by my school. I'll post it in my question right away~ –  Gnijuohz May 15 '12 at 0:05
    
Added :) Does that mean it's blocked by 115.156.255.174 ? –  Gnijuohz May 15 '12 at 0:11
    
@Gnijuohz Yes, it looks like 115.156.255.174 (a machine on the hust.edu.cn network) is blocking outgoing connections to port 22. –  Gilles May 15 '12 at 0:33

Based on your comment, it's almost certain that the school has some sort of filter in place to block either all non port 80 traffic or all non-whitelisted traffic. You could probably get away with a SSH HTTP tunnel as documented here, or you could try a browser based ssh client as shown here.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.