LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 04-22-2011, 04:17 PM   #1
r_jr
Member
 
Registered: Feb 2006
Distribution: Ubuntu
Posts: 66

Rep: Reputation: 0
Question unable to ssh without dropping firewall security on dsl modem


I have a home network with a linux dhcp server and a couple of clients. The Internet comes from a dsl modem with a different subnet than my wireless router. The network works fine and I have no problems, but I now need to ssh to a work computer and the only way I can do that is if I drop the security in my dsl modem. So I thought all I need to do is use port forwarding on my dsl modem, but it won't let me because it is on a different subnet. I tried putting the dsl modem on the same subnet, but that did not work and made it so I could not access anything. I finally managed to get it working again, but I was wondering if someone could tell me what I am doing wrong or how to set up my network so I can ssh using port forwarding.

 
Old 04-22-2011, 04:34 PM   #2
jschiwal
LQ Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 682Reputation: 682Reputation: 682Reputation: 682Reputation: 682Reputation: 682
I think you should provide some more details.
What is on a different subnet?
What do you mean dropping security on the DSL router?
Is the DSL router a NAT router?
Does the DSL router block outgoing connection attempts (like a proxy firewall may be setup except for http traffic?)

It is the router at work that needs to forward ssh connections to your work computer. Your ssh command (from home) will use the Internet IP address of your work router.
If your home DSL router is a NAT router, it will remember the connection and forward return traffic to the IP address that initiated the connection.

Last edited by jschiwal; 04-22-2011 at 04:37 PM.
 
Old 04-22-2011, 05:37 PM   #3
r_jr
Member
 
Registered: Feb 2006
Distribution: Ubuntu
Posts: 66

Original Poster
Rep: Reputation: 0
Router is on 192.168.0.* and dsl modem is on 192.168.1.*
Dropping security means just that, dropping it from medium to low. I don't know how else to explain this. They are predefined settings in the modem's firewall.

Is the DSL router a NAT router? Not sure, it is a Westell 6100 dsl modem from Verizon. It does have a Static NAT section and is set to some Microsoft setting rather than an IP.
Does the DSL router block outgoing connection attempts (like a proxy firewall may be setup except for http traffic?) Not sure.

It is the router at work that needs to forward ssh connections to your work computer. Your ssh command (from home) will use the Internet IP address of your work router.
If your home DSL router is a NAT router, it will remember the connection and forward return traffic to the IP address that initiated the connection.
--This does not really make sense to me. Why would I have to do anything at work? I am connecting to a broadband 3G modem with a static ip address and I can do so if I change the firewall settings in my dsl modem. That tells me, it is on my side. Am I wrong?

It seems to me it is the fact that the dsl modem and wireless router (wireless is disabled, I am using it more or less as switch) are on different subnets.

Okay, I looked at the Security Log in my DSL modem and it lists an Alert for source port 49074 and destination port 22 (ssh) that says "Alert: Packet to be dropped unless Service enabled"

I suspect they are talking about the ssh service.

I don't know how to fix that though since I can't figure out how to setup port forwarding of the ssh service.

So, if I try to port forward port 22 to say 192.168.0.215 I get a message that says "Address not part of Private Subnet"



 
Old 04-22-2011, 06:15 PM   #4
jschiwal
LQ Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 682Reputation: 682Reputation: 682Reputation: 682Reputation: 682Reputation: 682
From what I can gather, either your DSL service is being your ISP's own super NAT router and customers receive a private IP address, or the modem contains a 1 port router which translates the Internet IP address to a local address. It does look like your router is a NAT router that translates from your 192.168.0.* addresses of your LAN hosts so they share a single 192.168.1.* address that your DSL modem is assigned.

It also seems that your DSL modem also filters outgoing traffic, and only allows you to make connections on certain ports. You need to configure the modem to allow you to initiate outgoing ssh connections.

Port forwarding has nothing to do with this. You would use port forwarding to enable inbound ssh connection from the internet.
You will need to configure the router at your workplace to forward port 22 to your workstation or server at work.

NAT routers block initial inbound connections from the Internet, simply because they have no way to know which host on the inside they are for. Several hosts are sharing the same Internet address for traffic from the internet. Once a connection is established from the inside, the NAT router knows which hosts the return traffic is intended for.

In your case, your DSL modem is blocking outgoing traffic. It does this on a port by port basis. You need to enable port 22 (ssh) for outgoing connections in its configuration.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
LXer: Secure Access To Your DSL Modem’s Telnet through ssh LXer Syndicated Linux News 0 03-11-2009 08:00 AM
Linux box security when net connected via router and DSL modem ? uncle-c Linux - Security 4 08-19-2008 08:54 PM
Netgear WGR514v6 to Westell DSL modem, which has firewall? ToothlessRebel Linux - Networking 6 01-27-2007 05:52 PM
SSH >> DSL Modem Headaches mpapet Linux - Networking 6 09-23-2006 10:25 AM
Speedtouch DSL modem and firewall mikemrh9 Linux - Security 1 03-16-2005 12:58 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 03:22 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration