3

I'm trying to set up a simple SSH server, but the port is still filtered even after port forwarding. (I've set up SSH to use port 1338 instead of default 22.)

We can see that the port is filtered by running a Nmap scan on the local IP (where the port is open) and then on the external IP.

Running nmap on local IP:

$ nmap -p 1338 -Pn 192.168.1.144
Starting Nmap 7.70 ( https://nmap.org ) at 2019-12-17 16:34 CET
Nmap scan report for 192.168.1.144
Host is up (0.0030s latency).

PORT     STATE SERVICE
1338/tcp open  wmc-log-svc

Nmap done: 1 IP address (1 host up) scanned in 0.08 seconds

Running nmap on external IP:

$ nmap -p 1338 -Pn <server's external IP>
Starting Nmap 7.70 ( https://nmap.org ) at 2019-12-17 16:34 CET
Nmap scan report for <external-IP>.<ISP-info> (<external IP>)
Host is up.

PORT     STATE    SERVICE
1338/tcp filtered wmc-log-svc

Nmap done: 1 IP address (1 host up) scanned in 2.07 seconds

Port forward settings (this is an ASUS RT-N12D1 Router if that's relevant):

enter image description here

What could cause this? It looks like there's a firewall stopping communication but I don't have any firewall configured. I recently moved and took over the previous tenant's internet service, maybe there's a firewall between my router and the internet?

Edit

This user is talking about Linux filtering incoming connections. My server is running a fresh install of Ubuntu 16.04 and as far as I know Ubuntu does not ship with a pre-configured firewall.

Edit

I logged traffic using tcpdump and I can confirm that the traffic is not blocked by the server itself (i.e. traffic is being filtered by either the router or something earlier in the chain).

Improve this question
6
  • Did you call nmap both times from the same address? That means the internal network.
    – Mathias Weidner
    Dec 17, 2019 at 18:41
  • Yes, what's your point?
    – Mossmyr
    Dec 17, 2019 at 21:08
  • 1
    It depends on how the NAT and port forwarding is set up. When you connect to the outside address of your router from the inside, the NAT may not come to effect at all. It may also be possible that the NAT will be active but the return packets won't be sent via the router but directly. In that case the router may see it as half open connection and block further packets. It is difficult to tell. A packet capture on the SSH server as well on the scanning machine may tell you more. The best would be, if you scan from somewhere outside.
    – Mathias Weidner
    Dec 18, 2019 at 11:56
  • Thanks, but even from outside the network I can't connect.
    – Mossmyr
    Dec 18, 2019 at 21:52
  • Does the ASUS router have firewall rules and if yes, did you allow the traffic there? It is sometimes tricky to get the firewall rules right when NAT is included. You may start allowing access to the external port 1338 as well as to the internal address/port and then experiment to find out if both are necessary.
    – Mathias Weidner
    Dec 19, 2019 at 12:30

4 Answers 4

Reset to default
2

It turns out my ISP was using Carrier-grade NAT, which essentially means I have a private IP address. The solution was to call them and ask for a public IP address.

Improve this answer
2
  • 1
    How did you find out your ISP was using Carrier-grade NAT?
    – Dr-Bracket
    Jun 30, 2020 at 3:23
  • @Dr-Bracket I called and asked.
    – Mossmyr
    Jul 1, 2020 at 14:58
1

You can run into numerous issues if you are scanning a public ip that is forwarded to the machine you are scanning from. Numerous routing and network address translation issues can occur. To start out, I'd recommend you scan the ip and port from a machine outside of your firewall, and monitor the traffic at the destination machine. That should help you at least be able to determine if the packet is making it through your router/firewall. Also occasionally ISPs will block ports if they are associated with bad traffic like viruses and botnets, so you might want to test a couple of ports. I've seen ports blocked on more than one occasion.

Improve this answer
1
  • I've tried accessing it from outside my local network, same results. I talked to my ISP today and they said all ports are open.
    – Mossmyr
    Dec 19, 2019 at 10:56
0

In Asus router you have to go to "Administration" and then in "System" in the bottom enable the ssh access choosing the ip of your server (destination ip).

Improve this answer
0

Consider checking what backward gateway you have in your in-LAN Linux. For example, I had in my /etc/netplan:

...
  gateway4: 192.168.1.2

Which was unchanged leftover after moving from the previous home network and was different from the current LAN home router IP. Changing this to the actual gateway IP fixed everything to work again. And Nmap is now "open", not "filtered".

– TLDR of suffering story:

What I diagnosed and how it was:

Forwarded port 22 (also a few others) is set up correctly but shown as "filtered" by Nmap and inaccessible. Also, I had timeouts on connection attempts manually from an external machine to this 22 port on the WAN of the 5G home router.

I can see the "open" ports status if I Nmap-test those ports inside the local network towards this Ubuntu.

I did all possible checks. I even did set up for test to forward the 5900 port from outside to my iMac, and it is shown as Open by Nmap and works, and all settings are similar to that for the 22 port for the Ubuntu.

I even disabled ufw on Ubuntu: ufw disable, removed iptables everything.

More: this Ubuntu, without changing configurations with the same ports, was in another home with another router, and it had ports forwarded to it and worked normally.

Also: ISP does not restrict ports. WAN IP is public from (sadly not static though :P).

I tested even with different 5G routers and did not succeed in the same way - 5900 possible, 22 not.

Hardware restarted, also. But the main proof that I should dig into Ubuntu was that 5900 forwarding test with iMac passed.

In the end I ... at last :), figured out that Ubuntu had wrong gateway ^_^.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .