- THE SETUP
Two machines at home, behind a residential cable modem and router:
gaia: Kubuntu 10.04, 192.168.0.103
pixel: Ubuntu 10.04, 192.168.0.104
router: DLink DI-52, 184.108.40.206 (not its real IP). The router is configured to forward ports 23 and 10002 to pixel:22, and to forward ports 22 and 10001 to gaia:22.
Two external hosts on different networks in different states:
zeus: CentOS, IP 220.127.116.11 (not its real IP) in Texas
argo: Kubuntu 10.04, IP 18.104.22.168 (not its real IP) in California
- THE PROBLEM
If I SSH from zeus to router:22, :23, :10001, or :10002, it connects fine (to gaia, pixel, gaia, and pixel, respectively).
If I SSH from argo to router:23 or :10002, it connects to pixel fine. If I SSH from argo to router:22 or :10001, it does not connect to gaia; the SYN packet is never replied to (I watched this with Wireshark on gaia to verify that gaia does not send anything back to argo). Also tested with other hosts on the same network as argo; none of them get any farther. The SSH dump (-vvv) looks like this:
@@ 08:29:04 Sat Sep 18 [user@argo - ~]$ ssh 22.214.171.124 -vvv OpenSSH_5.3p1 Debian-3ubuntu4, OpenSSL 0.9.8k 25 Mar 2009 debug1: Reading configuration data /home/user/.ssh/config debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug2: ssh_connect: needpriv 0 debug1: Connecting to 126.96.36.199 [188.8.131.52] port 22. debug1: connect to address 184.108.40.206 port 22: Connection timed out ssh: connect to host 220.127.116.11 port 22: Connection timed out @@ 08:39:00 Sat Sep 18 [user@argo - ~]$
Now, to make things even weirder: I have a VPN client on gaia that lets me get past the firewall that is on argo's corporate network. This VPN client gives gaia an additional IP (172.16.1.1, again not real). If I try to ssh to THAT IP from argo, it connects just fine.
So my question is, what the hell is going on? Does gaia for some reason just not like the IP that argo is using? gaia is a two-day-old Kubuntu install, and I haven't done anything weird like configure certain IP ranges to be blocked from connecting to sshd. And it doesn't seem like it could be something about the SYN packet that gaia doesn't like, since it WILL let argo connect if it's to the VPN IP.
EDIT: I just discovered that this problem only occurs when the VPN client is running on gaia. As soon as I shut it off, argo can connect to gaia through its public IP just fine. Any idea why this would be?
EDIT 2: My next guess is that the VPN client tells the IP stack to ignore any packets coming from the corporate firewall's public IP, to make sure that while the VPN is active, all data from gaia to the corporate network goes through the VPN, and not through the public firewall. This doesn't cause me a real problem, because I can still SSH directly to gaia using its VPN IP instead of the router's IP, but it's a little confusing.