Re: cannot ssh into my own machine

From: Dave Ewart (davee_at_sungate.co.uk)
Date: 12/08/04

  • Next message: Hugo Vanwoerkom: "Re: cron jobs + (some?) output" 
    Date: Wed, 8 Dec 2004 13:26:46 +0000
To: debian-user@lists.debian.org

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    On Wednesday, 08.12.2004 at 00:58 -0500, Kamaraju Kusumanchi wrote:

    > Running debian sid.
    >
    > Let's say my machine's external IP is 69.212.23.215 and internel IP is
    > 192.168.0.101. I am connected to the internet through DI-514 router. I
    > do port forwarding to get ssh functionality.
    >
    >
    > >From this machine (192.168.0.101), I can do
    > ssh 192.168.0.101 -l username
    >
    > I cannot do
    > ssh 69.212.23.215 -l username
    >
    > But from outside world, I can do
    > ssh 69.212.23.215 -l username
    >
    > Why am I not able to ssh into my own machine using the external IP
    > address? Is this a limitation of Debian or the defect in the router or
    > a configuration hiccup?

    When you do 'ssh 69.212.23.215 -l username' locally, it is possible that
    the port forwarding rules of your router are not triggered.

    Normally, port forwarding of this type forwards from the external
    interface of the router (the public interface) to the internal
    interface.

    In other words, the rule that the router is obeying is "When some
    connection comes in on port 22 for IP 69.212.23.215 on the external
    interface, forward it to 192.168.0.101 on the internal interface"

    A connection from your local machine to 69.212.23.215 does NOT pass over
    the external interface of your router, and so won't be matched by that
    rule. It will attempt to login to your router, in fact, via SSH - on
    its internal (local) interface.

    Whether you can change the router's behaviour depends on the router
    itself.

    Dave.
    - --
    Dave Ewart - davee@sungate.co.uk - jabber: davee@jabber.org
    All email from me is now digitally signed, key from http://www.sungate.co.uk/
    Fingerprint: AEC5 9360 0A35 7F66 66E9 82E4 9E10 6769 CD28 DA92

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.4 (GNU/Linux)

    iD8DBQFBtwEWnhBnac0o2pIRAiozAJ9kamZcTGbA8vjFFjAHMtQ1rm5gMwCfeuu6
    AZVepEMhmHkS36FYfsakDgU=
    =jZPC
    -----END PGP SIGNATURE----- 

    -- 
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
  • Next message: Hugo Vanwoerkom: "Re: cron jobs + (some?) output"

    Relevant Pages

    • Re: cant access external ip from internal lan
      ... It could be a limitation of your router. ... interface destined for the external interface that needs to be forwarded ... back to a machine on the internel interface). ... > webserver from any internal PC using the internal IP of the webserver but ...
      (microsoft.public.inetserver.iis)
    • Re: D-Link DI-804, how to block ping? JPG Screen Shot How-To
      ... Check out GRC.com and do the Shields Up! ... Google for "port forwarding". ... Log in to your router and find the Advanced tab and then choose the Firewall ... Destination - Interface "LAN" ...
      (comp.security.firewalls)
    • Re: cant access external ip from internal lan
      ... It is actaully a combo dsl modem and router in one. ... > interface destined for the external interface that needs to be forwarded ... > back to a machine on the internel interface). ... >> webserver from any internal PC using the internal IP of the webserver but ...
      (microsoft.public.inetserver.iis)
    • [Full-Disclosure] FW: Cisco Vulnerability forensic protocol analysis results.
      ... AMILABS CISCO IP PROTOCOL EXPLOIT TESTING RESULTS ... Cisco router interfaces using either all or one of the following IP ... of a remote Cisco interface uses all of them. ... output buffer failures, 0 output buffers swapped out Router4# ...
      (Full-Disclosure)
    • Re: Site-to-Site VPN client routing question - clients at branch office not able to acce
      ... I would recommend that you use some other machine as your router, ... select the demand-dial interface from the dropdown list. ... On the RRAS server in Shanghai, configure a demand-dial interface and give it a static route to 194.1.1.0/24 as above. ... This makes sure that the connection is made to the correct dd interface and sets up the correct route back to Shanghai through the VPN link. ...
      (microsoft.public.windows.server.networking)
    Loading