I'm playing sysadmin for a day and standing up a new Ubuntu 12.04 box. The box has 2 NICs - 1 for internal connections, one for external. I'm able to ssh into the box using the internal ip (ssh me@172.XXX.XXX.XXX), but not through the external name or IP. Ultimately, I get the all too familiar "Operation timed out" message.
Info that may or may not be useful to experienced admins:
- I don't have anything fancy in my iptables (default content)
sshd_confighas the box listening everywhere for everything
- Telnet also fails (
telnet 172.XXX.XXX.XXX 22)
/var/log/syslogfiles don't even blink when I try to connect.
A verbose tcpdump seems to indicate that the request is making it to the machine.
$ sudo tcpdump -vvv -s 1600 -i any port 22 | grep "172.XXX.XXX.XXX" 71.XXX.XXX.XXX.43784 > 172.XXX.XXX.XXX.ssh: Flags [S], cksum 0xde3e (correct), seq 613836537, win 65535, options [mss 1380,nop,wscale 4,nop,nop,TS val 806048442 ecr 0,sackOK,eol], length 0
At this point, I'm way over my head and only Google has gotten me this far. I'm not sure what else to try. If anyone can offer any insight, additional debugging methods or shed light on this in any other way, I'd very much appreciate it.
$ sudo iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination
Note that I'm currently SSH'd into the box via the internal IP.
$ sudo netstat -pant |grep ":22" tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 10691/sshd tcp 0 0 172.XXX.XXX.XXX:22 172.XXX.XXX.105:49948 ESTABLISHED 10055/sshd: me tcp6 0 0 :::22 :::* LISTEN 10691/sshd
This is a high level overview of how an external request gets routed from start to finish:
- my.domain.net resolves to 12.XXX.XXX.37
- 12.XXX.XXX.37 passes the request through to the external router
- The router forwards things along to a firewall
- The firewall forwards SSH requests to 172.XXX.XXX.XXX (the box in question)
- 172.XXX.XXX.XXX apparently decides it doesn't like the incoming request and ignores it.
The last step is what I'm trying to fix, of course. :-)