Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am in holiday in another country and trying to ssh on a server from my home country. I think the ISP here blocked that IP/class for various reasons. Is there a way I can bypass this ? I can ssh on any other machine without any problems (well, not from my home country, but still ...).

share|improve this question
    
Which country are you in, right now? And to which country are you trying to connect? –  Wim ten Brink Aug 9 '09 at 18:47
    
Does it matter? I am in Serbia, trying to reach Romania. –  hyperboreean Aug 9 '09 at 19:06
    
Is there anyone you can call to configure anything on the remote server? I'm guessing no? If you can get some 'remote hands' then there may be some solutions. –  Mark Henderson Aug 9 '09 at 21:33

8 Answers 8

It seems like a proble with the firewall that reach your server. Have you tried to do a nmap to your server:

nmap -p 22 yourserver

I think that the result is going to be filtered or closed. One solution could be to establish a VPN to your office/datacenter and connect to your server as a local connection.

share|improve this answer
    
Yes, it's filtered, but I am pretty sure no one changed the firewall while I was gone. Also, on another ip, from the same class which has no firewall, I have the same problem. –  hyperboreean Aug 9 '09 at 20:59

gotossh.com

share|improve this answer
    
Seriously? Is GotoSSH secure? How do you know they aren't really keeping your credentials? What about if your SSHD is configured to only allow SSL authentication? –  Dscoduc Aug 10 '09 at 5:59
    
He wanted to get around possible restrictions. The OP also never mentioned that his SSHD process is configured to only allow SSL authentication. So yeah, seriously. What I would personally do is jump on my server, reconfigure the sshd process, restart sshd, hop off gotossh.com, ssh in now that I can, passwd, and go about my business. –  David Rickman Aug 10 '09 at 6:05
    
But I mean, god forbid I use some random proxy server that I find on the internet.... –  David Rickman Aug 10 '09 at 6:07
    
I just meant that the whole point of SSH security is to protect the credentials of your account. So to use an online SSH client, sharing your credentials and such, seems crazy to me... –  Dscoduc Aug 10 '09 at 18:45
    
And, random proxy is fine as long as you are using SSL and can check to make sure they aren't doing forward SSL inspection... –  Dscoduc Aug 10 '09 at 18:46

One suggestion (not an immediate fix unfortunately) would be to reconfigure your SSHD to listen on port 443. Then your client software will appear to any proxy and/or firewalls as HTTPS traffic instead of SSH traffic.

If you are forced to go through a proxy server than you can use an SSH client like WinSCP that supports connecting through a proxy server...

I wrote up an article about this topic that some might find useful...

share|improve this answer
    
Port 443 in particular works well because firewalls and proxy servers tend to let it through unmolested. –  Gerald Combs Aug 20 '09 at 17:38
    
The catch here is if a proxy server is between your client and server, and the proxy is performing SSL Bridging (SSL inspection). In this scenario the SSH traffic would probably be detected by the proxy server and terminated... –  Dscoduc Aug 20 '09 at 19:42

As a temporary solution you can ssh to your server from another server you actually can ssh to.

share|improve this answer
    
Actually I tried that as well and it doesn't work either. I can ping the server tough. –  hyperboreean Aug 9 '09 at 19:05
    
Try setting a VPN to somewhere and then connect. But personally I think that the ssh deamon isn't running or the sshd configuration permits only certain IPs. Try to do an NMAP scan and see if it discovers any ports, or if you have a http running try connect to it. –  Alakdae Aug 10 '09 at 7:44

Have you tried a connection outside Serbia?

If you can ssh a server outside Serbia you could simply use it as node to ssh your Romanian server. That could solve a problem of filtering outgoing connection.

An other option could be to find a way to set Romanian server's port 80 as ssh port, but you said you can ssh any other server...

share|improve this answer
    
Hi Andrea, I mentioned in Alakdae's comment that I can't ssh to my server even from another server outside Serbia. This might mean that's not a problem with the ISP here filtering packets, but with the romanian one ? Thanks! –  hyperboreean Aug 9 '09 at 19:35
    
Yes it could mean that, or you could not have configured the remote box correctly. –  Joseph Kern Aug 24 '09 at 10:44

I don't know if you can get any 'remote hands' at the server to install and configure something for you, but I've used a solution called Hamachi to get around this sort of thing before.

Hamachi is a VPN service, however if you can't VPN to the other host for whatever reason (like, the IP is blocked), then the Hamachi servers will route and tunnel your request for you (at a limited speed however, but it's enough for SSH).

So, just as long as they haven't blocked the Hamachi servers, they will proxy your connection for you. Assuming you can get someone to install and configure it at the other end. Which I'm guessing you probably can't, or else you wouldn't be asking us here.

share|improve this answer
    
No, I can't at this hour. I can't even to see the sshd banner when telneting on 22. Isn't this a hint that it's not a firewall problem? If it were to be rejected the connection would have received at least the banner. –  hyperboreean Aug 9 '09 at 21:43
    
If the IP is being blocked by the country you are in, then you wouldn't see anything at all, it would be as if the connection doesn't exist. Which is why a proxy to a 'safe' server outside the country is most likely the only option. Can you run a really long network cable into Croatia? (just kidding) –  Mark Henderson Aug 9 '09 at 21:49

Without some way to get back to the console or have someone else you trust work on the system you may not have many options; you don't have VPN access to the network the machine is in...the only way to reconfigure it is to actually be back there.

When you do have access back there you can try reconfiguring the server to run SSHD on a different port then use -p to connect when outside your country again.

Also are you running anything like Denyhosts? Or firewalling the system? It's possible that it accidentally locked you out in that case. I've had that happen with denyhosts; I have to add my IP to a safelist in /etc/hosts.allow when that happens.

Either way you may be out of luck until you get a chance to return to your home area to do some reconfiguring.

share|improve this answer
up vote 0 down vote accepted

The problem was with the ISP we're using. It seems that from time to time they have this kind of issues.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.