Problem with SSH and Firewall (Newbie)

elitecodex · 03-25-2004, 07:38 AM

Ok, here is my situation.

I have setup a MDK 10 machine at my home with a SSH daemon running. I have my machine and my fiance's machine (Win XP) behind a Linksys router/firewall. I can connect to my machine from the XP machine via putty. I have asked my friend that is outside the firewall to try to connect and it worked with no problem... now here is the problem.

I am trying to connect with putty at work (Win2K) and I keep on getting the error "Network error: connection timed out" or something of that nature. There is no output and a log is never generated. I use a program at work over port 23, so Im assuming its availble through the firewall. I have almost unlimited access to the internet (for the exception of 'bad' sites).

Does anyone have any idea of what is going on and how it can be fixed (if it can be fixed). Is there a way to determine what ports are available to me without the proxy server or network admin detecting a port scan?

This is a double-sided issue... Im relatively new to networking and very new to linux.

Thanks for any help in advance.

AutOPSY · 03-25-2004, 08:53 AM

you may need to enable port 22 port forwarding on your router.

port 22 tcp/udp = ssh
port 23 tcp/udp = telnet

when you use port forwarding on the router you will specify the port and LAN IP of your machine runnind the sshd.

When you connect externallly from the LAN, you would use your IP address from your ISP. I belive.

elitecodex · 03-25-2004, 08:59 AM

hmmm

Well, that would probably answer the question of the firewall at work. However, my friend who is outside of my firewall (1000 miles away) could connect with no problem. Would it be possible for two different applications to work over the same port at the same time? Can I have the SSHD run on port 23?

pingswept · 03-25-2004, 04:10 PM

Putty defaults to port 23, but sshd defaults to 22. If you switch putty to 22, you should be able to connect from work, no problem.

You can definitely have multiple connections to sshd on port 22 simultaneously.

One other subtlety is the difference between incoming and outgoing ports. Sshd is listening for incoming connections on port 22. When you are sshing from work, you are going out through some random high-numbered port (like 23465). Most likely, your firewall at work doesn't block any ports going out. (Maybe they should, but they probably don't.)

elitecodex · 03-30-2004, 12:14 PM

New update... I still cannot SSH in... still getting a "Connection timed out" error. I can at least get a response from Telnet... here is what the PuTTY log says:

Code:

2004-03-30 13:07:01	Looking up host "<IP Here>"
2004-03-30 13:07:01	Connecting to <IP Here> port 23
2004-03-30 13:07:01	client:	WILL NAWS
2004-03-30 13:07:01	client:	WILL TSPEED
2004-03-30 13:07:01	client:	WILL TTYPE
2004-03-30 13:07:01	client:	WILL NEW_ENVIRON
2004-03-30 13:07:01	client:	DO ECHO
2004-03-30 13:07:01	client:	WILL SGA
2004-03-30 13:07:01	client:	DO SGA
2004-03-30 13:07:22	Network error: Connection timed out

Any ideas on what to do next?

mgatny · 03-30-2004, 06:11 PM

2004-03-30 13:07:01 Connecting to <IP Here> port 23

This indicates that putty is still trying to connect on the telnet port (port 23). You need to tell
putty to connect on the ssh port (port 22), or you will never get there.

elitecodex · 03-31-2004, 06:03 AM

But I have tried on both port 22 and 23. Neither gets a response other than "Connection timed out" (using ssh)

mgatny · 03-31-2004, 09:50 AM

Let's find out where your packets are going, and whether they are getting to your home router at all. Run a traceroute from work to your home IP and post the output. From the win2k command line:
<a href="http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q162/3/26.asp&NoWebContent=1">tracert</a> <Your Home IP>

mgatny · 03-31-2004, 09:51 AM

Sorry about that bogus html. The link was:
http://support.microsoft.com/default...NoWebContent=1

And the command was:
tracert <Your Home IP>

elitecodex · 03-31-2004, 05:55 PM

Ok, I'll do that tomorrow (I didnt get the message until I got home)

But if it helps, I do have an proftpd running and I can FTP into my home computer with no problem.

elitecodex · 04-01-2004, 07:34 AM

Ok... this is confusing. Here is the output for my tracert

Code:

Tracing route to <hostname> [<ip>]
over a maximum of 30 hops:

  1   <10 ms   <10 ms   <10 ms  20.17.96.1 
  2    10 ms   <10 ms    10 ms  20.17.96.5 
  3    71 ms    60 ms    70 ms  vpn3-mgmt.aus.csc.com [20.17.156.35] 
  4    60 ms    70 ms    71 ms  Aus-Ign-Rrtr1.aus.csc.com [20.17.160.27] 
  5    60 ms    70 ms    70 ms  20.17.44.2 
  6    70 ms    70 ms    70 ms  192.168.100.18 
  7    60 ms    70 ms    70 ms  20.136.112.18 
  8     *        *        *     Request timed out.
  9    70 ms    60 ms    61 ms  20.137.118.2 
 10    70 ms    70 ms    80 ms  t3-2-2-0.ar2.DAL1.gblx.net [64.214.196.25] 
 11    70 ms    70 ms    80 ms  pos3-0-2488M.cr2.DAL1.gblx.net [67.17.70.237] 
 12   101 ms   100 ms   110 ms  so1-0-0-2488M.ar2.CHI1.gblx.net [67.17.71.82] 
 13    91 ms   100 ms   100 ms  208.51.6.26 
 14   100 ms   100 ms   100 ms  tbr1-p013902.cgcil.ip.att.net [12.122.11.205] 
 15   110 ms   110 ms   120 ms  tbr1-cl1.n54ny.ip.att.net [12.122.10.1] 
 16   110 ms   120 ms   120 ms  tbr2-cl2.n54ny.ip.att.net [12.122.9.130] 
 17   110 ms   120 ms   120 ms  tbr2-cl1.wswdc.ip.att.net [12.122.10.54]
 18   110 ms   120 ms   110 ms  tbr1-cl1.attga.ip.att.net [12.122.10.70] 
 19   120 ms   120 ms   120 ms  gbr4-p40.ormfl.ip.att.net [12.122.2.182] 
 20   120 ms   120 ms   120 ms  gbr2-p100.ormfl.ip.att.net [12.122.5.134] 
 21   120 ms   120 ms   121 ms  gar3-p370.ormfl.ip.att.net [12.123.32.181] 
 22   130 ms   131 ms   130 ms  12.124.85.26 
 23   130 ms   130 ms   160 ms  68.56.0.54 
 24     *        *        *     Request timed out.
 25     *        *        *     Request timed out.
 26     *        *        *     Request timed out.
 27     *        *        *     Request timed out.
 28     *        *        *     Request timed out.
 29     *        *        *     Request timed out.
 30     *        *        *     Request timed out.

Trace complete.

Keep in mind, that the FTP still works ok because I can get into it with no problem. If the FTP works, why would the tracert not get through??