Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm playing sysadmin for a day and standing up a new Ubuntu 12.04 box. The box has 2 NICs - 1 for internal connections, one for external. I'm able to ssh into the box using the internal ip (ssh me@172.XXX.XXX.XXX), but not through the external name or IP. Ultimately, I get the all too familiar "Operation timed out" message.

Info that may or may not be useful to experienced admins:

  • I don't have anything fancy in my iptables (default content)
  • My sshd_config has the box listening everywhere for everything
  • Telnet also fails (telnet 172.XXX.XXX.XXX 22)
  • My /var/log/auth.log and /var/log/syslog files don't even blink when I try to connect.
  • A verbose tcpdump seems to indicate that the request is making it to the machine.

    $ sudo tcpdump -vvv -s 1600 -i any port 22 | grep "172.XXX.XXX.XXX"
    71.XXX.XXX.XXX.43784 > 172.XXX.XXX.XXX.ssh: Flags [S], cksum 0xde3e (correct), seq 613836537, win 65535, options [mss 1380,nop,wscale 4,nop,nop,TS val 806048442 ecr 0,sackOK,eol], length 0

At this point, I'm way over my head and only Google has gotten me this far. I'm not sure what else to try. If anyone can offer any insight, additional debugging methods or shed light on this in any other way, I'd very much appreciate it.

Current iptables

$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination 


Note that I'm currently SSH'd into the box via the internal IP.

$ sudo netstat -pant |grep ":22"
tcp        0      0    *               LISTEN      10691/sshd      
tcp        0      0 172.XXX.XXX.XXX:22         172.XXX.XXX.105:49948      ESTABLISHED 10055/sshd: me
tcp6       0      0 :::22                   :::*                    LISTEN      10691/sshd    

Request Routing

This is a high level overview of how an external request gets routed from start to finish:

  1. ssh
  2. resolves to 12.XXX.XXX.37
  3. 12.XXX.XXX.37 passes the request through to the external router
  4. The router forwards things along to a firewall
  5. The firewall forwards SSH requests to 172.XXX.XXX.XXX (the box in question)
  6. 172.XXX.XXX.XXX apparently decides it doesn't like the incoming request and ignores it.

The last step is what I'm trying to fix, of course. :-)


share|improve this question
Please show the iptables you have. – cjc Aug 10 '12 at 12:38
Question has been updates with current iptables output. – Rob Wilkerson Aug 10 '12 at 12:45
Hmpfh. sudo netstat -pant |grep ":22"? Yes, I'm checking your work. – cjc Aug 10 '12 at 12:54
Where is the box located? Is there an external firewall? – cjc Aug 10 '12 at 13:09
Is this router set as a default gateway on your VM? – Alex Aug 10 '12 at 13:26
up vote 0 down vote accepted

You can use route | grep default on the VM to find your default gateway. If it is not the router a port is forwarded from this is a root of the problem - VM sends packets back to the default GW not to the port forwarding router.

share|improve this answer
I didn't have a route defined for my second NIC (eth1), much less have it as the default. I had to add the following line to my /etc/network/interfaces file: up route add default gw 172.XXX.XXX.1 eth1 – Rob Wilkerson Aug 10 '12 at 16:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.