I'm failing to set-up an ssd on port 9922. With standard configuration on port 22 everything works fine. Then I change the port to 9922 by adding this line to ths sshd_config file:

Port 9922

I can connect to the server in the LAN on port 22 without prolems. After switching to port 9922 I get the following ouptput:

# ssh -vvv -p 9922 root@
OpenSSH_4.3p2, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to [] port 9922.
debug1: connect to address port 9922: No route to host
ssh: connect to host port 9922: No route to host

And nmap -p 9922 gives:

# nmap -p 9922

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2012-06-11 08:09 CEST
Interesting ports on
9922/tcp filtered unknown
MAC Address: 4A:34:E7:11:9F:22 (Unknown)

Nmap finished: 1 IP address (1 host up) scanned in 0.184 seconds

Any ideas what's missing?

ifconfig on the target machines gives:

eth0      Link encap:Ethernet  Hardware Adresse 4A:34:E7:11:9F:22  
          inet Adresse:  Bcast:  Maske:
          inet6 Adresse: fe80::4834:e7ff:fe11:9f22/64 G?ltigkeitsbereich:Verbindung
          RX packets:2723010 errors:0 dropped:0 overruns:0 frame:0
          TX packets:552 errors:0 dropped:0 overruns:0 carrier:0
          Kollisionen:0 Sendewarteschlangenl?nge:1000 
          RX bytes:561183811 (535.1 MiB)  TX bytes:52703 (51.4 KiB)

lo        Link encap:Lokale Schleife  
          inet Adresse:  Maske:
          inet6 Adresse: ::1/128 G?ltigkeitsbereich:Maschine
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          Kollisionen:0 Sendewarteschlangenl?nge:0 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

And route -n:

# route -n
Kernel IP Routentabelle
Ziel            Router          Genmask         Flags Metric Ref    Use Iface   UG    0      0        0 eth0   U     0      0        0 eth0     U     1002   0        0 eth0         UG    0      0        0 eth0

iptables -L returns:

# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
  • Is the firewall at configured to allow incoming connections to 9922? – Hex Jun 11 '12 at 5:45
  • It's a vanilla CentOs 6.2 installation. I did not set-up a firewall. Is there something set-up by default? – BetaRide Jun 11 '12 at 5:50
  • "No route to host" says it all. Your network interface and/or your routing table can not find a route for the target address. What's the result of ifconfig and route -n? – ripat Jun 11 '12 at 6:05
  • 2
    check if there are default rules "iptables -L" . Make sure if you can see the server by "ping" – Hex Jun 11 '12 at 6:25
  • 2
    Woa, I was sure it was that :) I missed this part in your previews message: REJECT all -- anywhere anywhere reject-with icmp-host-pro This was what have blocked your traffic – Hex Jun 11 '12 at 6:34

While it is not a smart idea to stop the firewall i would propose to start the firewall and allow incomming port 9922 by

/sbin/iptables -A INPUT -p tcp --dport 9922 -j ACCEPT

  • Yes, of course. Stopping it was just a quick test. – BetaRide Jun 11 '12 at 7:34

You must likely have SELinux enabled at your server. If you don't need it, disable it temporarily with setenforce 0 or permanently by modifying /etc/selinux/config file.

If you want to use SELinux, make it allow sshd to bind to port 9922:

semanage port -a -t ssh_port_t -p tcp 9922

For me was a combo of Selinux and Firewall, I found the solution doing in this way:

As already proposed, relaxing Selinux:

semanage port -a -t ssh_port_t -p tcp 9922

And after that, changing even the firewall permission:

sudo firewall-cmd --zone=public --add-port=9922/tcp --permanent
sudo firewall-cmd --reload

These two changes make me possible to access to the server with the new ssh-port

  • 1
    A small note: firewall-cmd works when you have firewalld running. From the output of iptables -L it appears the OP does not use firewalld. – Onnonymous Apr 5 '17 at 11:02

You can have multiple Port lines in your sshd.conf, e.g.

Port 22
Port 2222
#Protocol 2,1
Protocol 2
#AddressFamily any
#ListenAddress ::

I typically do this because I'll have an external firewall/NAT open on the alternative port, but will want internal systems to hit the server on the traditional port 22.

Please make sure you restart the ssh daemon (service sshd restart) following any configuration file changes.

What happens if you nmap -p 9922 Does it show the port open?

The error in your ssh client debug output should be "Connection timed out" instead of "No route to host". What's in between you and the target system?

  • There's nothing between the two machines. They are in the same LAN. – BetaRide Jun 11 '12 at 6:08
  • Did you restart the ssh daemon? The nmap output indicates that it's not listening on the preferred port. netstat -anp | grep sshd on the target server would confirm this. – ewwhite Jun 11 '12 at 6:23
  • Yes, I did. And I can confirm that sshd is running and listening on port 9922. – BetaRide Jun 11 '12 at 6:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.