2

While setting up my raspberry pi with apache2, shh and more at a new address I've encountered a problem.

My setup consists of a router with port forwarding 80, 443 and 22 to my RPI's static local IP, ethernet connection. Everything runs smoothly for a while. I'm able to connect via HTTP, HTTPS and SSH through my domain pointing to my static remote IP. After about 10 hours it does, however, start to misbehave. If I do a sudo reboot on the RPI the setup works fine for about 10 hours.

  • When checking ports through canyouseeme.org all previously open ports seem to have closed.

    Error: I could not see your service on xxx.xxx.xx.xx on port (80/443/22) Reason: Connection timed out

  • The apache server is still running and can be accessed through its local IP. Same goes for ssh.

  • sudo nmap localhost

    Starting Nmap 7.01 ( https://nmap.org ) at 2018-05-24 14:34 CEST
    Nmap scan report for localhost (127.0.0.1)
    Host is up (0.00049s latency).
    Not shown: 991 closed ports
    PORT     STATE SERVICE
    21/tcp   open  ftp
    22/tcp   open  ssh
    25/tcp   open  smtp
    80/tcp   open  http
    139/tcp  open  netbios-ssn
    443/tcp  open  https
    445/tcp  open  microsoft-ds
    631/tcp  open  ipp
    3306/tcp open  mysql
    
  • Apache2 and SSH are listening on their ports.

    regnar@wserver:~$ sudo lsof -iTCP -sTCP:LISTEN -P
    [sudo] password for regnar: 
    COMMAND   PID     USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
    sshd     1162     root    3u  IPv4  12110      0t0  TCP *:22 (LISTEN)
    sshd     1162     root    4u  IPv6  12112      0t0  TCP *:22 (LISTEN)
    vsftpd   1171     root    3u  IPv6  14735      0t0  TCP *:21 (LISTEN)
    mysqld   1175    mysql   16u  IPv4  15391      0t0  TCP localhost:3306 (LISTEN)
    apache2  1233     root    4u  IPv6  12169      0t0  TCP *:80 (LISTEN)
    apache2  1233     root    6u  IPv6  12173      0t0  TCP *:443 (LISTEN)
    master   1491     root   12u  IPv4  13109      0t0  TCP localhost:25 (LISTEN)
    master   1491     root   13u  IPv6  13110      0t0  TCP ip6-localhost:25 (LISTEN)
    smbd     1498     root   34u  IPv6  15584      0t0  TCP *:445 (LISTEN)
    smbd     1498     root   35u  IPv6  15585      0t0  TCP *:139 (LISTEN)
    smbd     1498     root   36u  IPv4  15586      0t0  TCP *:445 (LISTEN)
    smbd     1498     root   37u  IPv4  15587      0t0  TCP *:139 (LISTEN)
    apache2 11103 www-data    4u  IPv6  12169      0t0  TCP *:80 (LISTEN)
    apache2 11103 www-data    6u  IPv6  12173      0t0  TCP *:443 (LISTEN)
    apache2 11104 www-data    4u  IPv6  12169      0t0  TCP *:80 (LISTEN)
    apache2 11104 www-data    6u  IPv6  12173      0t0  TCP *:443 (LISTEN)
    apache2 11105 www-data    4u  IPv6  12169      0t0  TCP *:80 (LISTEN)
    apache2 11105 www-data    6u  IPv6  12173      0t0  TCP *:443 (LISTEN)
    apache2 11106 www-data    4u  IPv6  12169      0t0  TCP *:80 (LISTEN)
    apache2 11106 www-data    6u  IPv6  12173      0t0  TCP *:443 (LISTEN)
    apache2 11107 www-data    4u  IPv6  12169      0t0  TCP *:80 (LISTEN)
    apache2 11107 www-data    6u  IPv6  12173      0t0  TCP *:443 (LISTEN)
    cupsd   15513     root   10u  IPv6 107704      0t0  TCP ip6-localhost:631 (LISTEN)
    cupsd   15513     root   11u  IPv4 107705      0t0  TCP localhost:631 (LISTEN)
    
  • UFW shouldn't be blocking the incoming connections. I've tried disabling it as well.

    regnar@wserver:~$ sudo ufw status
    Status: active
    
    To                         Action      From
    --                         ------      ----
    Samba                      ALLOW       Anywhere                  
    Apache                     ALLOW       Anywhere                  
    Apache Full                ALLOW       Anywhere                  
    Apache Secure              ALLOW       Anywhere                  
    OpenSSH                    ALLOW       Anywhere                  
    Postfix                    ALLOW       Anywhere                  
    Samba (v6)                 ALLOW       Anywhere (v6)             
    Apache (v6)                ALLOW       Anywhere (v6)             
    Apache Full (v6)           ALLOW       Anywhere (v6)             
    Apache Secure (v6)         ALLOW       Anywhere (v6)             
    OpenSSH (v6)               ALLOW       Anywhere (v6)             
    Postfix (v6)               ALLOW       Anywhere (v6)    
    
  • I CAN ping my domain / remote IP from outside but I can't connect through HTTP, HTTPS or SSH.

  • I have tried restarting the router
  • I have tried using another local IP

The setup (with a different router and different ISP) has been working for a long period at my previous address, but with the new connection / router the small setup seems to be having some trouble.

Anyone out there got a possible solution?

Kind Regards

  • 2
    Your question would be easier to read if you replaced the two pictures of your text output with actual text rather than pictures of the text. (copy/paste) Many of the users are going through lots of questions in a setting. You'll get a better response if you make it easy on the ones trying to help. Welcome to Askubuntu! – L. D. James May 24 '18 at 10:01
  • If you have dynamic IP address at your new address, but didn't (having static) at your prior address - it could be due to time (10 hours) your home has a new IP address, but you're not reflecting that change. Check your IP addresses from your router, or can you login to your router (externally) after the ~10 hours? (and not just ping) – guiverc May 24 '18 at 10:04
  • @guiverc My new connection provides a static IP. Should've made it more clear. Thank you for your reply. – Regnar May 24 '18 at 10:10
  • 2
    @L.D.James Thank you for your warm welcome and thanks for the suggestion. I've updated what I could provided the two different states of my setup (working/not working) – Regnar May 24 '18 at 10:29
  • Is it exactly 10h (or an exact period), or is it roughly the same time of day? Might you have a IP address conflict. Is your rpi connected to the router by WiFi, Ethernet, both? What's the router dhcp lease time? – pbhj May 24 '18 at 13:24
1

After shutting down WAN access to SHH the setup runs smoothly without problems. From my /var/log/auth.log it was clear that "script kids" were trying to gain access through SHH with random users entries. My setup apparently didn't like that.

NB If you really need SSH access from the WAN I highly recommend that you change its external port to something non-standard.

  • Change port, use firewall, use fail2ban, use keys instead of passwords. – pbhj Jun 5 '18 at 15:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.