Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are using ubuntu 10.04 LTS server.I can ssh access that server from other ubuntu machine in own network. But when we are trying to access the server from out side of LAN we are unable to ssh connect.I can give the outputs : starlite@starlite-laptop:~$ nmap -A -T4

Starting Nmap 5.00  at 2011-05-20 14:03 IST
Interesting ports on
Not shown: 996 closed ports
22/tcp   open  ssh        OpenSSH 5.3p1 Debian 3ubuntu5 (protocol 2.0)
|  ssh-hostkey: 1024 00:12:34:45:56:67:78:89:9070:91 (DSA)
|_ 2048 5d:96:00:12:34:45:56:67:78:89:90:36:70:91:a6 (RSA)
5001/tcp open  apc-agent  APC PowerChute agent
5432/tcp open  postgresql PostgreSQL DB
8080/tcp open  http       Apache Tomcat/Coyote JSP engine 1.1
|_ html-title: Apache Tomcat
Service Info: OS: Linux; Device: power-device

Service detection performed. Please report any incorrect results at .
Nmap done: 1 IP address (1 host up) scanned in 8.35 seconds

but when nmap from a different global IP the output is

starlite@starlite-laptop:~$ nmap 122.XXX.XXX.XXX -p 22 

Starting Nmap 5.00  at 2011-05-20 16:50 IST
Interesting ports on 122.XXX.XXX.XXX:
22/tcp closed ssh
The ssh connection is terminated as shown below - 
starlite@starlite-laptop:~$ ssh openbravo@
ssh: connect to host 122.XXX.XXX.XXX port 22: Connection refused

please help me how can I overcome this problem

share|improve this question
I edited the question for security reasons so the 122.XXX.XXX.XXX just assume it is the IP you posted before. – Luis Alvarado May 20 '11 at 13:33
@CYREX You do realize that the IP addresses are still available in the revision history, right? :) – Azendale Jul 7 '11 at 16:15
I can only do so much. At least it gives the user chance to change things. – Luis Alvarado Jul 7 '11 at 16:50

Did you check if the IP for the server is Class C (Local Network) or has an Internet IP. If it is local you will not be able to connect to it except rerouting from the Internet IP assign to that network.

Class C IP are for example: (Common one used in cafes) and tipically any 192.168.X.X

In your question the ip is Class C which is not accessible by normal means except rerouting connections.

The other ip 122.XXX.XXX.XXX is an Internet IP which will work

What i recommend is telling the router that connects to the Internet (The one that has the 122.XXX.XXX.XXX) to redirect all connections to that port to the IP in the network.

share|improve this answer
he posted his ip. it is pingable... though maybe not so good an idea to post too much information – con-f-use May 20 '11 at 13:30
You are correct. Edited the question an my answer for security reasons. – Luis Alvarado May 20 '11 at 13:33

You need to NAT the servers internal IP address to a public Internet address. Not sure what type of router/gateway you are using, but for most home users this is a matter of enabling a specific IP to act as the DMZ host and then use some form of dynamic DNS to make the name public. For businesses you would want to work with your IP on getting a static IP address that is public and providing your firewall rules are setup to accept TCP/22.

share|improve this answer

Will elaborate later. Just a list of key points for now:

  • ssh port forwarding (in router or internet gateway; usually port 22)
  • Iptables
share|improve this answer

You probably need to go to your router's web interface and forward port 22 to Looking at the addresses you mentioned, you should go to http://192.1681.1.1/ in a web browser and look for a Port forwarding page. You might look at and see if your router is on there. If so, there should be directions on how to forward ports for your specific router.

I would also like to point out that once you get port forwarding set up, you will still have to use the internal address,, to ssh in from the local network (behind the router) and use the external address, 122.XXX.XXX.XXX, to login from everywhere else. This is because NAT is just really an ugly kludge to save IPv4 addresses (and therefore doesn't do very well with the model of having a server behind it). A 'hairpin' NAT would fix this, but most NAT implementations aren't hairpin. (I wish we could just use IPv6 and get rid of NAT already so we wouldn't have little confusing problems like this!)

share|improve this answer

I think the problem is with the firewall, try something like:

iptables -I INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.