SSH from Internet to Pi

I'd like to ask for tips. I have a Pi running a number of services. One is SSH to allow Telnet access via Putty. I use certificates for authentication. While at home on LAN I can Putty into the Pi just fine using IP 192.168.0.181:22

I have dynamic DNS for external access so I can use address <me>.ddns.net:22 then port forwarding on my router to the Pi. Now this works with other services like web server. So I know DDNS and port forwarding works.

What could be blocking SSH? Anyway to check logs on Pi?

Thanks!

Hello Geeknix!

Sunday April 23 2023 10:30, you wrote to me:

Should only be TCP - according to my router settings for port trigger but both for port forwarding so look correct.

Yep, for ssh that is best as far as I know but I have extra security that means users system must have declared MAC code (I also make use of users CPU model and serial numbers - but that was an experiment that seems to work.

Vincent

Do you have any firewalling on the Pi, router or ISP that might interfere? Try a different external port other than 22?

To see logs:

On the client, Putty has a logging window that tells you what happened on its side of the connection. On ther server, /var/log/auth.log often tells you if there was a problem with keys or similar.

Post the logs here if you need help with them.

Theo

Not sure what you mean, when I open the port on the router I have selected All (i.e. TCP and UDP) for port 22.

I have disabled username/password and only accept pre-shared keys.

Thanks Vincent.

Thanks for your reply. I haven't knowingly setup a firewall on the Pi perhaps the router has one but the same steps I use to allow HTTP and Minecraft have opened those ports for use.

Great, I'll try and figure out how to see that window.

I'll check that out also. Thank you.

I have tried port 4444 for external access, that still forwards to port

Should be no different. I have a similar setup here - Ah!

I remember. I couldn't forward port 22. The router was using it for secure remote login.

Just try using an arbitrary high port on the router.

Pedantry, maybe, but Telnet != ssh

Telnet offers a very basic tty-like service over a plaintext channel, while ssh provides a secure, encrypted service. Their connection protocols are not compatible.

Similarly with ftp vs. ssh2 for file transfers: I wouldn't dream of using telnet, ftp or Kermit outside my LAN, which is firewalled off from the wider Internet, but I have no problems with using ssh or ssh2 to log in to a remote (trusted) system or to transfer files to or from them.

Use 'nmap' to see what ports are accessible on your firewall, rpi's etc from inside your LAN.

Hmm. Let me see how I did it here. Ok I used a high port on the router and 22 on the target machine

Worked for me on *86 platform. Mint. so basically debian with frills

Have you enabled global access to sshd in /etc/ssh/sshd.config and friends?

I think that is the default, but check anyway

Match Address is the line to look at. I think

Ok a good way to test this is to telnet to the ssh port on your public interface and see whether the daemon is responding or not

$telnet media.larksrise.com 2345 Trying 212.69.38.60... Connected to media.larksrise.com. Escape character is '^]'. SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.5

....etc. Oh, I edited the port number, so don't get cute

Yes, on many routers you not only have to configure the port forwarding you also hove to open up the relevant ports on the firewall.

I think he said he already tried that.

Thanks for all the replies, I'm away from home until Wednesday (SG time), I'll try the suggestions then and let you all know the outcome!

RenMas

Ok, but you have to forward that port to your 102.168.0.181:22

You can also forward some highet ot to your 192.168.0.181:22 You have to do that on your router provided by your ISP.

Thank you everyone for your replies. I tried everything you mentioned and it all looked good. I turned on logging in Putty and more detailed logs in auth.log on sshd.

When fiddling with the router firewall I noticed I had 2 port forwards to 22 on the Pi. Basically I was forwarding 4440 (changed from 4444 as it seemed to be used by other protocols) and 22 from external to local

1. I deleted external 22 and left only 4440. And it started working around this time, so I suspect I created some kind of clash on the router!?

Anyway, is really great I can now access my Pi with SSH. Thanks again!

-- “Some people like to travel by train because it combines the slowness of a car with the cramped public exposure of 
an airplane.”

Dennis Miller