Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two CentOS 5 servers running iptables and apf.

I am having issues connecting with ssh from server 1 to server 2. I can connect from server 1 to a third server and from that third server to both 1 and 2.

In all cases I am using the IP address and not a host name.

I have stopped iptables and apf on all servers and it doesn't seem to change anything.

What is the best way to debug this process?

share|improve this question
clickfault: can you update this post to provide the exact error message that you are receiving when attempting to connect to the server? – Michael Gorsuch May 29 '10 at 11:45
ssh: connect to host port 22: Connection timed out – user44449 May 29 '10 at 13:43
up vote 0 down vote accepted

On the server, run the ssh daemon on a different port with debugging turned on, and connect to it with the ssh client with the verbose flag. As in:

sshd -ddd -p 2222

And on the client (server1) try:

ssh -vvv -p 2222 server2

That's the typical first step unless you have some other data to start with. If that doesn't help (doesn't give further clues), I would try strace or ltrace against the normal sshd on server2.

Good luck.

The general procedure here should be to eliminate classes of problems to narrow things down, as with any troubleshooting. Initially, I thought your question was specific to ssh (specifically OpenSSH on Linux), and checking the debugging messages is a valid first step if you have an ssh problem between 2 hosts.

However, you mentioned that other applications between the two boxes aren't working, which means that it's not an application-specific problem. OpenSSH debugging might help, but it's going to be worthwhile to assume there is something that's common to all these protocols (the network) that has a problem. Furthermore, you say that a third server can reach server2... so that eliminates a huge number of potential problems.

My best guess at the moment is, based on the connection timing out and the other info, that you have an iptables problem on either the server or client, something set to DROP packets outgoing from the client or incoming on the server, but only from that box and not others. I'm hobbled by my ignorance of APF on this point, I just use stock iptables.

If iptables is completely disabled (with the chain policies reset to ACCEPT), then you have to assume it's a more generic network problem. I asked about the netmask because I was thinking about similar problems I have seen in the distant past, where boxes on different subnets could talk, but ones on the same subnet didn't work. If "server3" is on a different network and can still reach server1 and server2, then it's not a routing issue.

Whatever the answer is here, I'm curious.

share|improve this answer
Server 2 says the port is already in use when started with the -ddd flag regardless of the port I pick (tried a half dozen open ports). The -vvv flag on the other end doesn't give any info - just hangs. ltrace didn't help either and I have no idea what to make of the strace output... It isn't just an sshd issue, other services like mysql, etc... are unreachable. However, I can reach both servers/services from computers outside of their subnet - just not from each other. Is there a way to add an iptables rule to allow outbound/inbound between them? – user44449 May 29 '10 at 7:31
Well, if iptables is turned off and the default ACCEPT access policy has been restored, I think the problem must be elsewhere. Do you have a netmask issue? – Scott McClung May 29 '10 at 7:36
netmasks appear fine. I added specific rules to the apf allow_hosts files which show up in the iptables but still no luck. Hopefully I'll have better luck tomorrow... Thanks! – user44449 May 29 '10 at 8:59
Are server1 and server2 on the same IPv4 subnet? Would you mind showing us your "iptables -L -v" output? – Scott McClung May 29 '10 at 16:40
I put in a request with the hosting company (dedicated servers). All of my other servers which have been configured with the same steps work except these two, which ifconfig shows having 192.168.0.x addresses, whereas the others all show their external IP's. I even set up a new server with the same steps testing the connectivity at each point and it had no issues, so hopefully they have some insight as I am stumped at the moment. Thanks for you ideas! – user44449 May 30 '10 at 5:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.