0

I've been in the process of setting up an SSH server on an otherwise brand new Ubuntu installation. However, the server is only accepting connections from the local network. If I attempt to connect to it via the public IP address, I get:

ssh: connect to host XXX.XXX.XXX.XXX port 31415: Connection refused

I've forwarded the necessary port, and allowed it through the firewall. I can ping the IP, and a port checker seems to detect the server, which leads me to believe its not a port forwarding issue.

Firewall rules:

31415/tcp                  ALLOW       Anywhere
31415/tcp (v6)             ALLOW       Anywhere (v6)

Netstat output:

...
tcp        0      0 0.0.0.0:31415           0.0.0.0:*               LISTEN      -
tcp        0    400 10.0.0.30:31415         10.0.0.18:16669         ESTABLISHED -
...

sshd_config:

...
# What ports, IPs and protocols we listen for
Port 31415
#Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
...

Is it an issue with my networking interface? Is there a setting that's forcing local-only connections? How do I go about forcing it to accept remote IPs as well as local ones?

  • 1. Did you try using nmap to detect if the port is available (open) from the connecting host?(nmap -p 31415 -Pn your_internet_ip) 2. Is your attempt to connect remotely from the same network (i.e. you are using the internet IP but from the same network?) because it could be that your router does not allow local loopback. (ICMP and TCP are handled differently with regards to local loopbacks on some devices) – sergtech May 21 '17 at 10:13
  • Thank you! The port was free, but my router was blocking local loopback connections just as you described. – Power Bolt May 21 '17 at 18:35
0

Answer based on the discussion above. For some routers, local loopback is handled differently for TCP and ICMP packets. Therefore, the router will respond to ping on the WAN address, but will not allow local network users to connect to port forward on WAN side.

To test the theory, nmap should be used to check the port is open, or the connection should be attempted from a remote address.

nmap -p 31415 -Pn your_internet_ip

or

go to http://canyouseeme.org and check from there (which is what the OP did).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.