External SSH Connection Fails

Question

I'm playing sysadmin for a day and standing up a new Ubuntu 12.04 box. The box has 2 NICs - 1 for internal connections, one for external. I'm able to ssh into the box using the internal ip (ssh me@172.XXX.XXX.XXX), but not through the external name or IP. Ultimately, I get the all too familiar "Operation timed out" message.

Info that may or may not be useful to experienced admins:

• I don't have anything fancy in my iptables (default content)
• My sshd_config has the box listening everywhere for everything
• Telnet also fails (telnet 172.XXX.XXX.XXX 22)
• My /var/log/auth.log and /var/log/syslog files don't even blink when I try to connect.

• A verbose tcpdump seems to indicate that the request is making it to the machine.

  $ sudo tcpdump -vvv -s 1600 -i any port 22 | grep "172.XXX.XXX.XXX"
  71.XXX.XXX.XXX.43784 > 172.XXX.XXX.XXX.ssh: Flags [S], cksum 0xde3e (correct), seq 613836537, win 65535, options [mss 1380,nop,wscale 4,nop,nop,TS val 806048442 ecr 0,sackOK,eol], length 0
  

At this point, I'm way over my head and only Google has gotten me this far. I'm not sure what else to try. If anyone can offer any insight, additional debugging methods or shed light on this in any other way, I'd very much appreciate it.

Current iptables

$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination 

netstat

Note that I'm currently SSH'd into the box via the internal IP.

$ sudo netstat -pant |grep ":22"
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      10691/sshd      
tcp        0      0 172.XXX.XXX.XXX:22         172.XXX.XXX.105:49948      ESTABLISHED 10055/sshd: me
tcp6       0      0 :::22                   :::*                    LISTEN      10691/sshd    

Request Routing

This is a high level overview of how an external request gets routed from start to finish:

1. ssh me@my.domain.net
2. my.domain.net resolves to 12.XXX.XXX.37
3. 12.XXX.XXX.37 passes the request through to the external router
4. The router forwards things along to a firewall
5. The firewall forwards SSH requests to 172.XXX.XXX.XXX (the box in question)
6. 172.XXX.XXX.XXX apparently decides it doesn't like the incoming request and ignores it.

The last step is what I'm trying to fix, of course. :-)

Thanks.

Answer 1

You can use route | grep default on the VM to find your default gateway. If it is not the router a port is forwarded from this is a root of the problem - VM sends packets back to the default GW not to the port forwarding router.