LinuxQuestions.org
Visit Jeremy's Blog.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
Reload this Page New ISP / modem... Unable to connect to ssh server (or ping) remotely
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 06-04-2010, 07:52 PM   #1
Lyle
Member
 
Registered: May 2010
Location: Guyana, South America
Distribution: Debian, Sabayon
Posts: 37

Rep: Reputation: 15
New ISP / modem... Unable to connect to ssh server (or ping) remotely

Tried turning firewall off, i tried port forwarding tcp port 22, but it still doesn't work. Also am unable to ping modem over WAN, i can ping the modem locally though. Tech support claims pinging and ssh is not part of the internet so they wont support it in any way. Any ideas?
 
Old 06-04-2010, 08:15 PM   #2
thinknix
Member
 
Registered: Nov 2008
Distribution: Lots!
Posts: 178

Rep: Reputation: 58
It's likely your ISP is blocking port 22 and ICMP inbound. You can try a couple of things:

- Port forward some random high port (port 51326, for example) from your router/modem into your SSH server, still running on port 22. Your ISP is probably not blocking every inbound port. You can then try to connect like this from the outside:
Code:
ssh -p 51326 <modem/router external IP address>
- Use a reverse SSH tunnel to get around the port block. A good tutorial on that is here:

http://en.gentoo-wiki.com/wiki/Reverse_Tunneling

but it relies on an intermediate SSH server that you have access to from your LAN. This will always work if you can manage it, because your ISP won't block port 22 outbound from your LAN, which is what the connection will look like to them.
 
Old 06-04-2010, 08:33 PM   #3
Lyle
Member
 
Registered: May 2010
Location: Guyana, South America
Distribution: Debian, Sabayon
Posts: 37

Original Poster
Rep: Reputation: 15
Quote:
Originally Posted by slugmax View Post
It's likely your ISP is blocking port 22 and ICMP inbound. You can try a couple of things:

- Port forward some random high port (port 51326, for example) from your router/modem into your SSH server, still running on port 22. Your ISP is probably not blocking every inbound port. You can then try to connect like this from the outside:
Code:
ssh -p 51326 <modem/router external IP address>
- Use a reverse SSH tunnel to get around the port block. A good tutorial on that is here:

http://en.gentoo-wiki.com/wiki/Reverse_Tunneling

but it relies on an intermediate SSH server that you have access to from your LAN. This will always work if you can manage it, because your ISP won't block port 22 outbound from your LAN, which is what the connection will look like to them.
ok thanks ill try this
 
Old 06-04-2010, 10:49 PM   #4
LVsFINEST
Member
 
Registered: Aug 2006
Posts: 99

Rep: Reputation: 21
Where did you disable the firewall? SSH server? Modem? Router?

What type of modem do you have? Does it route/NAT or bridge (What device gets assigned the public IP)?

ICMP and SSH are definitely two services that are typically blocked by "out-of-the-box" routers (and/or modems, depending) and I'm thinking the problem lies within your local configuration on one of these devices.

It would be pretty shady for an ISP to block port 22, and almost unfeasible for them to block ICMP (entirely anyway).
 
Old 02-19-2011, 01:55 PM   #5
nsel
LQ Newbie
 
Registered: Feb 2011
Posts: 2

Rep: Reputation: 0
Similar problem, open routing on both host and gateway
Before I begin, a little info

ISP: Primus Canada (operates off of Bell Canada's network)
Modem: Thompson ST516 v6

after logging into speedtouch.lan through telnet, I get the firewall rule list:

Code:
{nsel}[firewall rule]=>list

Rules (flags: C=Constant, D=Dynamic, E=Enable, L=Log)
=====
Chain                            Nr.  Flags  Rule                                                        
---------------------------------------------------------------------------------------------------------
sink                             1    CDE                    : link             sink_fire 
                                 2    CDE                    : link             sink_system_service 
sink_system_service              1    CDE    PPTPD           : accept           PPTPD_sv_0 PPTPD_if_0.* > *.*
                                 2    CDE    PPTPGRE         : accept           PPTPGRE_sv_0 PPTPGRE_if_0.* > *.*
                                 3    CDE    HTTP            : accept           HTTP_sv_0 HTTP_if_0.* > *.*
                                 4    CDE    HTTPs           : accept           HTTPs_sv_0 HTTPs_if_0.* > *.*
                                 5    CDE    FTP             : accept           FTP_sv_0 FTP_if_0.* > *.*
                                 6    CDE    TELNET          : accept           TELNET_sv_0 TELNET_if_0.TELNET_ip_0 > *.*
                                 7    CD     RIP             : accept           RIP_sv_0 *.* > *.*
                                 8    CD     RIP-Query       : accept           RIP-Query_sv_0 *.* > *.*
                                 9    CDE    IGMP-Proxy      : accept           IGMP-Proxy_sv_0 *.* > *.*
                                 10   CDE    DNS-S           : accept           DNS-S_sv_0 DNS-S_if_0.* > *.*
                                 11   CDE    DHCP-R          : accept           DHCP-R_sv_0 DHCP-R_if_0.* > *.*
                                 12   CDE    DHCP-S          : accept           DHCP-S_sv_0 DHCP-S_if_0.* > *.*
                                 13   CD     SNMP_AGENT      : accept           SNMP_AGENT_sv_0 SNMP_AGENT_if_0.* > *.*
                                 14   CDE    SSDP            : accept           SSDP_sv_0 SSDP_if_0.* > *.*
                                 15   CDE    MDAP            : accept           MDAP_sv_0 MDAP_if_0.* > *.*
                                 16   CDE    CWMP-S          : accept           CWMP-S_sv_0 *.* > *.*
                                 17   CD     RAS             : accept           RAS_sv_0 *.* > *.*
                                 18   CD     SRAS            : accept           SRAS_sv_0 *.* > *.*
                                 19    D     ICMP_LISTEN     : accept           ICMP_LISTEN_sv_0 *.* > *.*
                                 20   CD     SENDTO_LISTEN   : accept           SENDTO_LISTEN_sv_0 *.* > *.*
                                 21    DE    PING_RESPONDER  : accept           PING_RESPONDER_sv_0 PING_RESPONDER_if_0.* > *.*
                                 22   CD     HTTPI           : accept           HTTPI_sv_0 HTTPI_if_0.* > *.*
forward                          1    CDE                    : link             forward_fire 
                                 2    CDE                    : link             forward_host_service 
                                 3    CDE                    : link             forward_level 
                                 4    CDE                    : link             forward_multicast 
forward_host_service             1    CDE    map_6_22-22:... : accept           map_6_22-22:22-22 *.* > *.map_6_22-22:_192_168_1_64
forward_level                    1    CDE                    : link             forward_level_Disabled 
forward_level_Disabled           1    C E    AnyTraffic      : accept           *.* > *.*
source                           1    CDE                    : link             source_fire 
                                 2    CDE                    : link             source_system_service 
source_fire                      1    C E    AnyTraffic      : accept           *.* > *.*
As well as chain list:

Code:
{nsel}[firewall chain]=>list

Chains
======
Name                                             Policy           Description     
----------------------------------------------------------------------------------
sink                                             accept           system          
forward                                          accept           system          
source                                           accept           system          
sink_fire                                        accept           system          
forward_fire                                     accept           system          
source_fire                                      accept           system          
sink_system_service                              accept           system          
source_system_service                            accept           system          
forward_level                                    accept           system          
forward_host_service                             accept           system          
forward_multicast                                accept           system          
forward_level_Disabled                           accept           user
on my host, my iptables is the following:

Code:
]# iptables --list
Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     tcp  --  speedtouch.lan       anywhere            tcp flags:!FIN,SYN,RST,ACK/SYN 
ACCEPT     udp  --  speedtouch.lan       anywhere            
ACCEPT     all  --  anywhere             anywhere            
LSI        udp  --  anywhere             anywhere            udp dpt:33434 
LSI        icmp --  anywhere             anywhere            
DROP       all  --  anywhere             255.255.255.255     
DROP       all  --  anywhere             192.168.1.255       
DROP       all  --  BASE-ADDRESS.MCAST.NET/8  anywhere            
DROP       all  --  anywhere             BASE-ADDRESS.MCAST.NET/8 
DROP       all  --  255.255.255.255      anywhere            
DROP       all  --  anywhere             0.0.0.0             
DROP       all  --  anywhere             anywhere            state INVALID 
LSI        all  -f  anywhere             anywhere            limit: avg 10/min burst 5 
INBOUND    all  --  anywhere             anywhere            
LOG_FILTER  all  --  anywhere             anywhere            
LOG        all  --  anywhere             anywhere            LOG level info prefix `Unknown Input' 

Chain FORWARD (policy DROP)
target     prot opt source               destination         
LSI        udp  --  anywhere             anywhere            udp dpt:33434 
LSI        icmp --  anywhere             anywhere            
LOG_FILTER  all  --  anywhere             anywhere            
LOG        all  --  anywhere             anywhere            LOG level info prefix `Unknown Forward' 

Chain OUTPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     tcp  --  island-of-nowhere.lan  speedtouch.lan      tcp dpt:domain 
ACCEPT     udp  --  island-of-nowhere.lan  speedtouch.lan      udp dpt:domain 
ACCEPT     all  --  anywhere             anywhere            
DROP       all  --  BASE-ADDRESS.MCAST.NET/8  anywhere            
DROP       all  --  anywhere             BASE-ADDRESS.MCAST.NET/8 
DROP       all  --  255.255.255.255      anywhere            
DROP       all  --  anywhere             0.0.0.0             
DROP       all  --  anywhere             anywhere            state INVALID 
OUTBOUND   all  --  anywhere             anywhere            
LOG_FILTER  all  --  anywhere             anywhere            
LOG        all  --  anywhere             anywhere            LOG level info prefix `Unknown Output' 

Chain INBOUND (1 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     udp  --  anywhere             anywhere            state RELATED,ESTABLISHED 
LSI        all  --  anywhere             anywhere            

Chain LOG_FILTER (5 references)
target     prot opt source               destination         

Chain LSI (6 references)
target     prot opt source               destination         
LOG_FILTER  all  --  anywhere             anywhere            
LOG        tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,ACK/SYN limit: avg 1/sec burst 5 LOG level info prefix `Inbound ' 
DROP       tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,ACK/SYN 
LOG        tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,ACK/RST limit: avg 1/sec burst 5 LOG level info prefix `Inbound ' 
DROP       tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,ACK/RST 
LOG        icmp --  anywhere             anywhere            icmp echo-request limit: avg 1/sec burst 5 LOG level info prefix `Inbound ' 
DROP       icmp --  anywhere             anywhere            icmp echo-request 
LOG        all  --  anywhere             anywhere            limit: avg 5/sec burst 5 LOG level info prefix `Inbound ' 
DROP       all  --  anywhere             anywhere            

Chain LSO (0 references)
target     prot opt source               destination         
LOG_FILTER  all  --  anywhere             anywhere            
LOG        all  --  anywhere             anywhere            limit: avg 5/sec burst 5 LOG level info prefix `Outbound ' 
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 

Chain OUTBOUND (1 references)
target     prot opt source               destination         
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     udp  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     all  --  anywhere             anywhere
This, to my understanding, should forward all requests through anywhere on either host or modem. Please correct me if I am wrong. I am going to try the above, the output is the following:

Code:
#ssh -p 51326 `ipnow`
ssh: connect to host [<my external ip> port 51326: Connection refused
ipnow is a script that resolves my external IP address.

If I try this using port 22 as usual on the other hand I get a connection timed out error.



Am I misunderstanding something?
 
Old 03-07-2011, 01:02 PM   #6
nsel
LQ Newbie
 
Registered: Feb 2011
Posts: 2

Rep: Reputation: 0
Thanks for all the help guys, that was awesome.

I'll remember to not bother next time, I ended up getting my answer elsewhere.
 
0 members found this post helpful.
Old 03-07-2011, 01:04 PM   #7
szboardstretcher
Senior Member
 
Registered: Aug 2006
Location: Detroit, MI
Distribution: GNU/Linux systemd
Posts: 4,278

Rep: Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694
Quote:
Originally Posted by Lyle View Post
Tried turning firewall off, i tried port forwarding tcp port 22, but it still doesn't work. Also am unable to ping modem over WAN, i can ping the modem locally though. Tech support claims pinging and ssh is not part of the internet so they wont support it in any way. Any ideas?
ping and ssh are not part of the internet? That tech support is awful.

Quote:
I'll remember to not bother next time, I ended up getting my answer elsewhere.
Care to share the answer you didnt receive here,.. because you tried hijacking a thread?
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Unable to connect to redhat 5 server using ssh, ftp. Avadhut Linux - Newbie 6 03-12-2009 12:18 AM
How do i configure guarddog so i can use SSH remotely and ping my box? asilentmurmur Slackware 5 08-03-2006 12:57 AM
Can connect to ISP but cannot ping anywhere acampbell Linux - Networking 12 08-22-2004 03:41 AM
Help: Unable to connect remotely tejpatil Linux - Newbie 3 02-14-2004 08:36 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 06:07 AM.

Contact Us - Advertising Info - Rules - Privacy - LQ Merchandise - Donations - Contributing Member - LQ Sitemap -
Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration