up vote 0 down vote favorite
share [g+] share [fb]

I have setup a test machine and tried to ssh from externally I get connection refused. But when I try from a local machine and local address it works well but if I try global ip it fails. I have port forwarded 22 to the machine. Any more steps I am missing? I have done this too netstat -ntlp and I can see the port 22 with sshd service.

Iptables details

kts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     udp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0           udp dpt:53 
    0     0 ACCEPT     tcp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0           tcp dpt:53 
    0     0 ACCEPT     udp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0           udp dpt:67 
    0     0 ACCEPT     tcp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0           tcp dpt:67 
    4   160 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
    4   240 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:9000 
   23  3671 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      virbr0  0.0.0.0/0            192.168.122.0/24    state RELATED,ESTABLISHED 
    0     0 ACCEPT     all  --  virbr0 *       192.168.122.0/24     0.0.0.0/0           
    0     0 ACCEPT     all  --  virbr0 virbr0  0.0.0.0/0            0.0.0.0/0           
    0     0 REJECT     all  --  *      virbr0  0.0.0.0/0            0.0.0.0/0           reject-with icmp-port-unreachable 
    0     0 REJECT     all  --  virbr0 *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-port-unreachable 
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           PHYSDEV match --physdev-is-bridged 
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 

Netstat-tulpn results


Chain OUTPUT (policy ACCEPT 28 packets, 3991 bytes)
pkts bytes target     prot opt in     out     source               destination

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name   
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      1593/sshd           
tcp        0      0 127.0.0.1:631               0.0.0.0:*                   LISTEN      1468/cupsd          
tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN      1671/master         
tcp        0      0 0.0.0.0:111                 0.0.0.0:*                   LISTEN      1349/rpcbind        
tcp        0      0 0.0.0.0:52084               0.0.0.0:*                   LISTEN      1413/rpc.statd      
tcp        0      0 192.168.122.1:53            0.0.0.0:*                   LISTEN      1862/dnsmasq        
tcp        0      0 :::22                       :::*                        LISTEN      1593/sshd           
tcp        0      0 ::1:631                     :::*                        LISTEN      1468/cupsd          
tcp        0      0 :::36952                    :::*                        LISTEN      1413/rpc.statd      
tcp        0      0 :::111                      :::*                        LISTEN      1349/rpcbind        
tcp        0      0 :::80                       :::*                        LISTEN      1694/httpd          
udp        0      0 0.0.0.0:741                 0.0.0.0:*                               1413/rpc.statd      
udp        0      0 0.0.0.0:5353                0.0.0.0:*                               1395/avahi-daemon:  
udp        0      0 0.0.0.0:111                 0.0.0.0:*                               1349/rpcbind        
udp        0      0 0.0.0.0:631                 0.0.0.0:*                               1468/cupsd          
udp        0      0 0.0.0.0:53019               0.0.0.0:*                               1395/avahi-daemon:  
udp        0      0 0.0.0.0:676                 0.0.0.0:*                               1349/rpcbind        
udp        0      0 192.168.122.1:53            0.0.0.0:*                               1862/dnsmasq        
udp        0      0 0.0.0.0:33975               0.0.0.0:*                               1413/rpc.statd      
udp        0      0 0.0.0.0:67                  0.0.0.0:*                               1862/dnsmasq        
udp        0      0 :::44763                    :::*                                    1413/rpc.statd      
udp        0      0 :::111                      :::*                                    1349/rpcbind        
udp        0      0 :::676                      :::*                                    1349/rpcbind        

 pkts bytes target     prot opt in     out     source               destination
link|improve this question
Are you trying the public IP from behind the same NATing router, or from outside? – Shane Madden Dec 19 '11 at 18:03
2  
Can you post the output of iptables -L -v -n as an edit to your question please. – Iain♦ Dec 19 '11 at 18:07
I trying the public ip behind the NATing router not from outside. The router is just a normal home router. – newbie14 Dec 19 '11 at 18:30
Output from netstat -tulpn? – Bart De Vos Dec 19 '11 at 18:40
dear bart I have put the results via editing my question any more things I should be on the look? – newbie14 Dec 20 '11 at 7:51
show 1 more comment
feedback

1 Answer

up vote 0 down vote accepted

If you can access it from a local address but not from an outside address, my guess is that the problem is the port forwarding on your router, and not iptables. If you want to confirm that, stop iptables on your server and try again from the outside.

If you're worried you'll be hacked while you test this (bit paranoid if you are, but eh...), then install and setup DenyHosts. If you already have it installed, then check your /etc/hosts.deny to see if it blocked you before.

If it works while iptables is off, then you know the problem is a bad rule somewhere in there.

link|improve this answer
yes I confirm is my modem problem nothing wrong with linux. Thank you. – newbie14 Feb 21 at 4:40
Please accept the answer by clicking the green checkmark if it was the problem. Thanks – Yanick Girouard Feb 21 at 18:21
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.