Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I attempt to connect to SSH server at 192.168.0.1. 192.168.0.2 is the client computer. The command I use is

ssh -p1111 user@192.168.0.1 

I get the error: connection refused. I have edited the config file to specify the same port in SSH. Below are my rules used in iptables. What should I do to make the connection work?

#!/bin/sh
iptables -F
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

iptables -A INPUT -p tcp --sport 1111 --src \
192.168.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 1111 --dst \
192.168.0.2 -j ACCEPT

iptables -A INPUT -p tcp --sport 1111 --src \
192.168.0.2 -j ACCEPT
iptables -A INPUT -p tcp --dport 1111 --dst \
192.168.0.1 -j ACCEPT

iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
iptables -A INPUT -f -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
iptables -A INPUT -m state --state INVALID -j LOG \
--log-level 4 --log-prefix 'InvalidDrop '
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m limit --limit 2/min -j LOG \
--log-level 4 --log-prefix 'In2/m '
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --sport 80 -j ACCEPT
iptables -A INPUT -p tcp --sport 443 -j ACCEPT
iptables -A INPUT -j LOG --log-level 4 --log-prefix 'InDrop '
iptables -A INPUT -j DROP
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -m limit --limit 6/hour -j LOG \
--log-level 4 --log-prefix 'OutAllow6/h '
iptables -A OUTPUT -j ACCEPT
share|improve this question
2  
Check that sshd is actually listening - netstat -tnlp | grep 1111 –  Iain Feb 16 '13 at 13:53
add comment

1 Answer

Is the SSH daemon on 192.168.0.1 actually listening on port 1111? Your SSH command and your Firewall, both indicate that you want to use SSH on port 1111, but did you actually configure the SSH daemon to listen on this port?

You would have to do this in /etc/ssh/sshd_config:

Port 1111

Then restart the SSH daemon and then it should be ok.

Also, your firewall indicates that SSH connections in the reverse direction will use port 1111 as well, so you would have to do the same on the SSH server of the client computer.

share|improve this answer
2  
Apart from iptables you nees to make sure SeLinux should not be refusing SSH connection on port 1111.You can disable SeLinux by setenforce 0. –  Abhishek Anand Amralkar Feb 16 '13 at 14:45
    
I have added Port 1111. I have added iptables rules for the client. The connection was successful. Thanks for the help. –  user2078443 Feb 17 '13 at 9:20
    
So can you connect now? –  mauro.stettler Feb 17 '13 at 9:22
    
After some time there is still the "connection refused" error. Is it a timeout configuration somewhere? –  user2078443 Feb 17 '13 at 9:23
    
Usually connection refused is not related to any timeouts. The message indicates that the Server has replied with a TCP packet, saying that this connection cannot be established. Usually this means that either no daemon is listening, or the firewall rejects the connection. Try doing a netstat -ntpl on the server to verify that the daemon listens on 1111 –  mauro.stettler Feb 17 '13 at 9:27
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.