0

I attempt to connect to SSH server at 192.168.0.1. 192.168.0.2 is the client computer. The command I use is

ssh -p1111 [email protected] 

I get the error: connection refused. I have edited the config file to specify the same port in SSH. Below are my rules used in iptables. What should I do to make the connection work?

#!/bin/sh
iptables -F
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

iptables -A INPUT -p tcp --sport 1111 --src \
192.168.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 1111 --dst \
192.168.0.2 -j ACCEPT

iptables -A INPUT -p tcp --sport 1111 --src \
192.168.0.2 -j ACCEPT
iptables -A INPUT -p tcp --dport 1111 --dst \
192.168.0.1 -j ACCEPT

iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
iptables -A INPUT -f -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
iptables -A INPUT -m state --state INVALID -j LOG \
--log-level 4 --log-prefix 'InvalidDrop '
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m limit --limit 2/min -j LOG \
--log-level 4 --log-prefix 'In2/m '
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --sport 80 -j ACCEPT
iptables -A INPUT -p tcp --sport 443 -j ACCEPT
iptables -A INPUT -j LOG --log-level 4 --log-prefix 'InDrop '
iptables -A INPUT -j DROP
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -m limit --limit 6/hour -j LOG \
--log-level 4 --log-prefix 'OutAllow6/h '
iptables -A OUTPUT -j ACCEPT
1
  • 2
    Check that sshd is actually listening - netstat -tnlp | grep 1111
    – user9517
    Feb 16, 2013 at 13:53

1 Answer 1

0

Is the SSH daemon on 192.168.0.1 actually listening on port 1111? Your SSH command and your Firewall, both indicate that you want to use SSH on port 1111, but did you actually configure the SSH daemon to listen on this port?

You would have to do this in /etc/ssh/sshd_config:

Port 1111

Then restart the SSH daemon and then it should be ok.

Also, your firewall indicates that SSH connections in the reverse direction will use port 1111 as well, so you would have to do the same on the SSH server of the client computer.

7
  • 2
    Apart from iptables you nees to make sure SeLinux should not be refusing SSH connection on port 1111.You can disable SeLinux by setenforce 0. Feb 16, 2013 at 14:45
  • I have added Port 1111. I have added iptables rules for the client. The connection was successful. Thanks for the help. Feb 17, 2013 at 9:20
  • So can you connect now?
    – replay
    Feb 17, 2013 at 9:22
  • After some time there is still the "connection refused" error. Is it a timeout configuration somewhere? Feb 17, 2013 at 9:23
  • Usually connection refused is not related to any timeouts. The message indicates that the Server has replied with a TCP packet, saying that this connection cannot be established. Usually this means that either no daemon is listening, or the firewall rejects the connection. Try doing a netstat -ntpl on the server to verify that the daemon listens on 1111
    – replay
    Feb 17, 2013 at 9:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .