SSH over internet local port blocked
 

At school it's not possible to SSH to my server at home.

To check the open ports
Is this the right way?

Let's clarify the situation a bit more. At home I have a server (port 22 is forwarded by the router). I want to SSH to this server. However (I think) port 22 is blocked.

How can I SSH to the home server?


I'm not an network expert, so I might be wrong at some points.

try to use
nmap your_IP
However, if the school blocks port 22, talk to the IT people

Hi,

The netstat output given (from school I assume and not at home) will probably only show processes that belong to the user that executed that command. You need to run this as user (probably not possible at school) to get all the information.

Depending on how good things are set up by the admin at school, it might not be possible to ssh from school to home.

One thing you could try: run ssh on port 80 instead of 22 (will not be possible if you also have apache running on port 80), and try connecting from school with ssh on port 80.

Some might say this is hacking, I personally see this as an (school) admin not knowing what he's doing. If things are set up correctly you should not be able to do this, but experience has shown that this sometimes does work.

Hope this helps.

BTW: Happy Birthday!!

Straight from the man page
It just prints network relation on your computer.
If you want to know open ports you should look for the word LISTEN in the state column. These are the port your computer waits for incoming connections. But to be sure that they are really open you have to check on the firewall.
Lists all firewall rules in place (maybe check on the -t nat and -t mangle table as well).

All the above only refers to your computer and not to the network.
Next stop on the way to your server would be the gateway.
should tell you which one it is.
If you can access the gateway check out the iptables rules to see which ports are open. If not trial and error remains.

What I saw from your netstat -nap output is that you can HTTP to the outside. Just put your SSH on port 80 and you should be set. Maybe port 443 is also an option.

I allready asked if they could open port 21 and 22 for FTP and SSH. However because there too lazy, they don't want to open the ports "It was too insecure, because there's no virus scanner on the server" (they use windows on the server).




===== Quote from druuna =====
Hi,

The netstat output given (from school I assume and not at home) will probably only show processes that belong to the user that executed that command. You need to run this as user (probably not possible at school) to get all the information.

Depending on how good things are set up by the admin at school, it might not be possible to ssh from school to home.

One thing you could try: run ssh on port 80 instead of 22 (will not be possible if you also have apache running on port 80), and try connecting from school with ssh on port 80.

Some might say this is hacking, I personally see this as an (school) admin not knowing what he's doing. If things are set up correctly you should not be able to do this, but experience has shown that this sometimes does work.

Hope this helps.

BTW: Happy Birthday!!
===== End quote =====

Well, I run gentoo linux from an usb-key, so I have complete root access.

When I use SSH over port 80, will I lose the regular functionality (webbrowsing etc)?



I will give it a try to see what ports are open. However, let's say I can use port 80 to SSH. What form sh should the SSH command have? Does it to be something like this?
Or I'm I wrong?


PS: How can I use more than one quote in a post?

Browsing will work. Except if you have a webserver on your homeserver on port 80.
The tunnel you configure will connect to remote_server as user "user", and create a reverse tunnel from port 22 at localhost (seen from the ssh server where you logged in) to port 80.
If I am correct.
So you would have to switch them (dont shoot me if I am wrong). You can test this and then use netstat -tapn | grep 80

But you can just run sshd on port 80 which seems alot simpler to me.

hey Konqi,

simplest solution would be to change the listening port in the ssh config file ( /etc/ssh/sshd_config) to port 80.

restart sshd service, also make sure that traffic to port 80 from your home router/firewall is forwarded to the home server.

To ssh from school just change the port in mutt to 80.

Cheers

Hi,

I'm not sure if you get the concept of my idea.

If you want to try my suggestion you should reconfigure your sshd (at home) to listen on port 80, not the default 22. If you have a website set up at home, things will become a bit more complicated because it already listens on port 80.....

After you have reconfigured sshd you can connect from the outside world with ssh to your ssh server which listens on port 80. Which would look something like this: ssh -p 80 username@ssh.at.home the -p sets the port to connect to.

But like I said before, this will only work if the admins at school did a lousy job setting up the firewall.

Your browsing (seen from school) won't be a problem. You are actually (mis)using the fact that the firewall is (hopefully for you) set up to allow all outgoing traffic with destination ports 80, 8080 or 443 (which are all default "web" ports).

Hope this clears things up a bit.

In my opinion this will definitely work - as port 80 from school is allowed. No matter if its a lousy or good job - if port 80 is allowed (for http) which it is then how can a admin can block it for ssh?

As others have stated you can change the SSHD listener to listen to another port. The solution I have used frequently is setting up my router so that it forwards a specific port on the outside to port 22 on the SSH server. I usually try to use 443 or 8080 but port 80 should work. That allows all your other SSH clients to use the same configuration as SSHD would still be listening on port 22 but allow you to get through from your school.

yes a very good idea by Chrislski - if your router supports port translation then this could work flawlessly.

Could use iptables to redirect incoming connections on port 80 from a certain address to port 22 on your machine. I guess the school has a fixed ip. Find it out and put something like this into your iptables rules.
Or check on the recent module of iptables and set up some knocking script. This script would need a remake but the idea should get across. You would definetly change the #We finally allow the user iptables script to the REDIRECT target.

Also note if your school uses a (transparent) proxy this wont work!

I will try to redirect port 80 on my router to port 22 on my server, so I can use port 22 for internal use and port 80 for external use.

I will try programs like iptables etc, however they're aren't installed on my usb-stick yet. I will install them when I'm at home.

You are going to want to configure iptables on the computer at home for the port redirecting. Not that having iptables configured on your thumb drive is a bad thing they just won't help if configured on the thumbdrive.