Linux - NetworkingThis forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
Let's clarify the situation a bit more. At home I have a server (port 22 is forwarded by the router). I want to SSH to this server. However (I think) port 22 is blocked.
How can I SSH to the home server?
I'm not an network expert, so I might be wrong at some points.
The netstat output given (from school I assume and not at home) will probably only show processes that belong to the user that executed that command. You need to run this as user (probably not possible at school) to get all the information.
Depending on how good things are set up by the admin at school, it might not be possible to ssh from school to home.
One thing you could try: run ssh on port 80 instead of 22 (will not be possible if you also have apache running on port 80), and try connecting from school with ssh on port 80.
Some might say this is hacking, I personally see this as an (school) admin not knowing what he's doing. If things are set up correctly you should not be able to do this, but experience has shown that this sometimes does work.
It just prints network relation on your computer.
If you want to know open ports you should look for the word LISTEN in the state column. These are the port your computer waits for incoming connections. But to be sure that they are really open you have to check on the firewall.
Code:
iptables -L -v
Lists all firewall rules in place (maybe check on the -t nat and -t mangle table as well).
All the above only refers to your computer and not to the network.
Next stop on the way to your server would be the gateway.
Code:
ip routes
should tell you which one it is.
If you can access the gateway check out the iptables rules to see which ports are open. If not trial and error remains.
What I saw from your netstat -nap output is that you can HTTP to the outside. Just put your SSH on port 80 and you should be set. Maybe port 443 is also an option.
try to use
nmap your_IP
However, if the school blocks port 22, talk to the IT people
I allready asked if they could open port 21 and 22 for FTP and SSH. However because there too lazy, they don't want to open the ports "It was too insecure, because there's no virus scanner on the server" (they use windows on the server).
===== Quote from druuna =====
Hi,
The netstat output given (from school I assume and not at home) will probably only show processes that belong to the user that executed that command. You need to run this as user (probably not possible at school) to get all the information.
Depending on how good things are set up by the admin at school, it might not be possible to ssh from school to home.
One thing you could try: run ssh on port 80 instead of 22 (will not be possible if you also have apache running on port 80), and try connecting from school with ssh on port 80.
Some might say this is hacking, I personally see this as an (school) admin not knowing what he's doing. If things are set up correctly you should not be able to do this, but experience has shown that this sometimes does work.
Hope this helps.
BTW: Happy Birthday!!
===== End quote =====
Well, I run gentoo linux from an usb-key, so I have complete root access.
When I use SSH over port 80, will I lose the regular functionality (webbrowsing etc)?
I will give it a try to see what ports are open. However, let's say I can use port 80 to SSH. What form sh should the SSH command have? Does it to be something like this?
I allready asked if they could open port 21 and 22 for FTP and SSH. However because there too lazy, they don't want to open the ports "It was too insecure, because there's no virus scanner on the server" (they use windows on the server).
===== Quote from druuna =====
Hi,
The netstat output given (from school I assume and not at home) will probably only show processes that belong to the user that executed that command. You need to run this as user (probably not possible at school) to get all the information.
Depending on how good things are set up by the admin at school, it might not be possible to ssh from school to home.
One thing you could try: run ssh on port 80 instead of 22 (will not be possible if you also have apache running on port 80), and try connecting from school with ssh on port 80.
Some might say this is hacking, I personally see this as an (school) admin not knowing what he's doing. If things are set up correctly you should not be able to do this, but experience has shown that this sometimes does work.
Hope this helps.
BTW: Happy Birthday!!
===== End quote =====
Well, I run gentoo linux from an usb-key, so I have complete root access.
When I use SSH over port 80, will I lose the regular functionality (webbrowsing etc)?
I will give it a try to see what ports are open. However, let's say I can use port 80 to SSH. What form sh should the SSH command have? Does it to be something like this?
Code:
ssh -R 80:localhost:22 user@remote_server
Or I'm I wrong?
PS: How can I use more than one quote in a post?
Browsing will work. Except if you have a webserver on your homeserver on port 80.
The tunnel you configure will connect to remote_server as user "user", and create a reverse tunnel from port 22 at localhost (seen from the ssh server where you logged in) to port 80.
If I am correct.
So you would have to switch them (dont shoot me if I am wrong). You can test this and then use netstat -tapn | grep 80
But you can just run sshd on port 80 which seems alot simpler to me.
When I use SSH over port 80, will I lose the regular functionality (webbrowsing etc)?
I'm not sure if you get the concept of my idea.
If you want to try my suggestion you should reconfigure your sshd (at home) to listen on port 80, not the default 22. If you have a website set up at home, things will become a bit more complicated because it already listens on port 80.....
After you have reconfigured sshd you can connect from the outside world with ssh to your ssh server which listens on port 80. Which would look something like this: ssh -p 80 username@ssh.at.home the -p sets the port to connect to.
But like I said before, this will only work if the admins at school did a lousy job setting up the firewall.
Your browsing (seen from school) won't be a problem. You are actually (mis)using the fact that the firewall is (hopefully for you) set up to allow all outgoing traffic with destination ports 80, 8080 or 443 (which are all default "web" ports).
In my opinion this will definitely work - as port 80 from school is allowed. No matter if its a lousy or good job - if port 80 is allowed (for http) which it is then how can a admin can block it for ssh?
As others have stated you can change the SSHD listener to listen to another port. The solution I have used frequently is setting up my router so that it forwards a specific port on the outside to port 22 on the SSH server. I usually try to use 443 or 8080 but port 80 should work. That allows all your other SSH clients to use the same configuration as SSHD would still be listening on port 22 but allow you to get through from your school.
Could use iptables to redirect incoming connections on port 80 from a certain address to port 22 on your machine. I guess the school has a fixed ip. Find it out and put something like this into your iptables rules.
Or check on the recent module of iptables and set up some knocking script. This script would need a remake but the idea should get across. You would definetly change the #We finally allow the user iptables script to the REDIRECT target.
Code:
#!/bin/bash
# Defining ports and time slice
PORT1=2001
PORT2=2002
# define some vars for easier reading and ajustment
IPT=/sbin/iptables
IPTI="$IPT -A CUSTOMINPUT -i ppp0"
NAME="--name ssh"
# Connect to first port an put RemoteHost in Recent List
# We still drop the connection so portscans don't find them
$IPTI -p tcp --dport $PORT1 -m recent $NAME --set -j REJECT
# Connect to the second port and see if we allready had
# a connection attempt in the last 2 seconds
$IPTI -p tcp --dport $PORT2 -m recent $NAME --update --seconds 2 --hitcount 1 -j REJECT
# We finally allow the user to login
#$IPTI -p tcp --dport 22 -m recent $NAME --rcheck --seconds 2 --hitcount 2 -j ACCEPT
# Maybe we should remove the IP from the list?
$IPTI -p tcp --dport 22 -m recent $NAME --remove -j ACCEPT
You are going to want to configure iptables on the computer at home for the port redirecting. Not that having iptables configured on your thumb drive is a bad thing they just won't help if configured on the thumbdrive.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
