9

Running Ubuntu 12.04, I've set up the OpenSSH server. I can connect from within LAN, but not from outside. I am using the same sshd_config file as on my other Ubuntu 12.04 machines (that sit in a different LAN).

$ ssh 192.168.0.2

works fine, but

$ ssh 65.76.97.222

(made up IP address) does not work. Nothing happens. No error message, or anything. The prompt just sits there.

Thanks to comments below, I have managed to verify via websites canyouseeme.org and ShieldsUP that port 22 is indeed open.

Using the option -vvv, I get the following:

$ ssh -vvv 65.76.97.222
OpenSSH_5.9p1 Debian-5ubuntu1.4, OpenSSL 1.0.1 14 Mar 2012
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to 65.76.97.222 [65.76.97.222] port 22.
debug1: Connection established.
debug1: identity file /home/myname/.ssh/id_rsa type -1
debug1: identity file /home/myname/.ssh/id_rsa-cert type -1
debug1: identity file /home/myname/.ssh/id_dsa type -1
debug1: identity file /home/myname/.ssh/id_dsa-cert type -1
debug1: identity file /home/myname/.ssh/id_ecdsa type -1
debug1: identity file /home/myname/.ssh/id_ecdsa-cert type -1

And then the prompt just sits there.

Further debug information from var/log/auth.log:

$ grep sshd /var/log/auth.log
[cutting old lines...]    
Jul  6 10:23:05 mymachine sshd[7871]: Did not receive identification string from 65.76.97.222

I am allowing any user to connect, in particular my own username. What confuses me is that I have not had this problem on any other machine, although they are on a different lan. This lan has only one computer attached to it. Any ideas of how to proceed from here?

3
  • try using the verbose option (-v, -vv, to -vvv) to get extra info re: the connection. e.g., ssh -vvv -p 51555 65.76.97.222.
    – amc
    Jul 5 '14 at 20:57
  • check the forwarding port canyouseeme.org
    – hwez
    Jul 5 '14 at 21:00
  • Thanks, I have edited my question to reflect your comments.
    – DustByte
    Jul 6 '14 at 8:05
4

Check your gateway on the SSH server is set to the router doing the port-forwarding.

route -n

The default route should point back to that router, otherwise, you will be able to initiate connections through it, but the ACK's won't go anywhere!

3

A couple of things for you to check.

  1. Check /etc/ssh/sshd_config and make sure that you don't have any funny AllowUsers entries.

  2. Specify the user that you want to connect as:

    ssh USER@SERVER
    ssh SERVER -lUSER
    
  3. Check your firewall (iptables):

    sudo iptables -L --line-numbers
    sudo iptables -L -t nat --line-numbers
    
1

Need to check that port forwarding is working correctly i usually check by going to https://www.grc.com/shieldsup > Proceed > put your port number in the box and click user specified custom port probe. That should tell you if that TCP port is in fact open to public

3
  • Thanks. I've edited my question to reflect your suggestion. Problem remains however.
    – DustByte
    Jul 6 '14 at 8:06
  • HUH well the network is ruled out so looks like a config issue. Try grep sshd /var/log/auth.log
    – meccooll
    Jul 6 '14 at 8:17
  • The following line is then added to auth.log: Jul 6 10:23:05 mymachine sshd[7871]: Did not receive identification string from 65.76.97.222
    – DustByte
    Jul 6 '14 at 8:29
1

Are you declaring a user?

ssh Jimmy@65.76.97.222 -p51555

If you gave the code the way you are using it then I believe that it will default to the current user name.

Furthermore, you need to have a user on the TARGET system with permission. in the above example "Jimmy"

1
  • I have indeed. I am only connecting with the same user all the time, and further, sshd_config allows any user to connect.
    – DustByte
    Jul 6 '14 at 8:07
1

Try logging in from a computer that is not on the network. I used an SSH app on my smartphone. At first, it didn't work but then I turned off the wifi and it worked as expected. I had the same issue with my webserver.

The issue has to do with NAT loopback.

Many routers and some security tools prevent loopback connections as a security feature. This means that a machine on your local network cannot connect to the external IP address (such as 208.112.93.73) of a machine that is also on your local network. Connecting to a local IP address (such as 192.168.0.2) of that same machine works fine.

Check if your router has an "enable NAT loopback" feature.

Not the answer you're looking for? Browse other questions tagged or ask your own question.