I'm having some issues setting up port forwarding using static NAT on a Cisco 881W ISR. I've confirmed that the ssh daemon is working from the linux box inside the nat. My question is regarding the fact that any inbound ssh connections are able to open the socket, but it appears the ssh handshake times out or is otherwise hampered by the NAT configuration on the router. I thought this to be odd, and have suffered through hours of googling to no avail. I've got other port forwards on the router and they work just fine -- HTTP and subversion on ports 8080 and 8081, respectively.
Here's my NAT, ACL, and interface configs:
interface Dialer0 description WAN-ADSL ip address negotiated no ip redirects no ip unreachables no ip proxy-arp ip mtu 1452 ip flow ingress ip nat outside ip virtual-reassembly zone-member security out-zone encapsulation ppp dialer pool 1 dialer-group 1 ppp authentication chap callin ppp chap hostname firstname.lastname@example.org ppp chap password 7 HERPADERPADERP no cdp enable ip nat translation timeout 30 ip nat inside source list 101 interface Dialer0 overload ip nat inside source static tcp 10.10.10.10 22 interface Dialer0 22 ip nat inside source static tcp 10.10.10.10 8080 interface Dialer0 8080 ip nat inside source static tcp 10.10.10.10 8081 interface Dialer0 8081 access-list 101 permit ip any any access-list 101 permit tcp any any established
Any words of wisdom that would help me get SSH to properly handshake and actually open a connection? I REALLY do not want to resort to telnet for remote access, and (as stated above), google comes up blank.
Since HTTP is going through just fine, I'm wondering if this is a configuration issue with SSH. For the record, I'm using a vanilla openssh daemon from the debian repository. I've also tested this with the ssh daemon running on my Macbook with the same results.