To describe the situation, I need to define three machines. On the local network I have a machine (LAPTOP) and a machine (SERVER) connected over WAN and LAN to the router, respectively. The third machine is an external vps (VPS).

I am trying to SSH into the SERVER from the LAPTOP using an explicit IP address. To accomplish this, I set up openssh servers (all machines are running Ubuntu) listening to port 22. On the router I gave a reserved IP address to SERVER and added a port forwarding rule for incoming port 22 to port 22 of the SERVER.

What is working: - SSH from VPS to SERVER - SSH from LAPTOP to SERVER using local hostname internal to local network

What is not working: - SSH from LAPTOP to SERVER using explicit IP address.

To try and debug I ran nmap to see if the port is being filtered. I ran the following command on both the VPS and the LAPTOP

nmap -sS -p 22 xx.xx.xx.xx

where the x's denote the literal external IP of the router of the local network. The result is as follows:

VPS: 22/tcp open ssh
LAPTOP: 22/tcp filtered ssh

Just to double check if I use local hostname from the LAPTOP the port is open as it should be. Why is the port filtered when SSH'ing from the LAPTOP when using the explicit external IP? Is the outgoing request being filtered by my router?

  • 1
    Your router is probably filtering traffic from laptop to external IP, either due to firewall rules, or routing issues from internal to published IP, check any firewall rules on your router to make sure you are allowed to access external IP, from internal network interface of the router. Check any logs on the router to see if anything is getting blocked or any routing issues reported. If you say what router you have, somebody might be able to give you more pointers. – rAlen Dec 31 '16 at 11:03
  • That's what I thought as well. I switched of firewall rules but that did not seem to change anything. I think the router is based off of a Sagemcom F@st 5360 for the Swiss Sunrise company. I found the log tabs in the browser gui but it does not show anything relevant. – Pankrates Dec 31 '16 at 12:10

Your problem comes from the fact that your router probably applies the port forwarding rules (DNAT chain in iptables) before the NAT (SNAT chain in iptables).

This stackexchange post explains the problem in details and shows you how to confirm it using tcpdump. Basically you should see that you send your SYN packet to your external IP but receive the SYN/ACK from SERVER's internal IP.

Edit: How to fix it: Do not connect to your external IP from within your internal network. Use SERVER's internal IP directly.

  • Looks like you indeed identified the issue, thanks. Interesting to learn this is not possible for that particular reason. Guess I'll just have to switch between hostnames depending on which network I am. – Pankrates Jan 1 '17 at 13:07
  • If you use a publicly accessible domain name (that you control) for SERVER and you have you own DNS recursor in your internal network (bind, unbound, ...): you can configure this DNS server as autoritative for this domain so that SERVER resolves to your internal IP. This means that when using an external DNS server, SERVER will resolve to your external public IP (that you have defined in your publicly accessible authoritative DNS server for your domain) and when using your internal DNS server, SERVER will resolve to SERVER's internal IP. – spongebob Jan 1 '17 at 15:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.