# sshd: lights on but nobody home?

## Princess Nell

Ever since I upgraded the firewall at home to OpenBSD 4.7, I've been unable to get port forwarding to work with ssh. The pf firewall is configured to forward external ssh connections to a private IP, Gentoo box on the internal LAN.

By all the documentation and FAQs I've perused, pf.conf is set up correctly. It logs that incoming ssh connections are forwarded to the internal Gentoo machine. But sshd never picks up, and a connection is never established. Here comes the weird bit and the reason I'm posting here: tcpdump on the Gentoo box shows a connection coming in from the firewall to port 22! But even running sshd in the foreground with elevated debug levels shows no connection.

```

# tcpdump -i eth0 -n host 11.22.33.44

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on eth0, link-type EN10MB (Ethernet), capture size 68 bytes

02:02:23.607373 IP 11.22.33.44.9018 > localhost.ssh: S 2360170464:2360170464(0) win 0 <mss 1380>

```

Has anyone seen this before? Should I look at particular sshd settings? ssh to the Gentoo box works fine when originating on the firewall. Is there a chance that pf somehow mangles those packets?

No firewall running on the Gentoo machine, btw.

----------

## Hu

Assuming you did not truncate the output from tcpdump, that output shows us that the Gentoo machine never issued a SYN|ACK nor did it issue a RST.  There is no way for sshd to configure its socket such that incoming requests receive no response at all.  If sshd is listening, you should see a SYN|ACK.  If it is not listening, you should see a RST.  Since you received neither, the TCP stack on the Gentoo machine did not respond to the SYN, and may not have processed it at all.  What is the output of ip a ; ip r ; netstat -ntl ; find /proc/sys/net/ipv4/conf -name rp_filter | while read f; do echo "$f: $(< $f)"; done ; iptables-save?

----------

## Princess Nell

```

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN

    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

    inet 127.0.0.1/8 brd 127.255.255.255 scope host lo

2: tunl0: <NOARP> mtu 1480 qdisc noop state DOWN 

    link/ipip 0.0.0.0 brd 0.0.0.0

3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000

    link/ether 00:1c:23:8b:7d:ea brd ff:ff:ff:ff:ff:ff

    inet 192.168.1.10/24 brd 192.168.1.255 scope global eth0

4: wlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000

    link/ether 00:1b:77:a8:fe:53 brd ff:ff:ff:ff:ff:ff

5: vboxnet0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000

    link/ether 0a:00:27:00:00:00 brd ff:ff:ff:ff:ff:ff

192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.10  metric 1 

127.0.0.0/8 dev lo  scope link 

default via 192.168.1.254 dev eth0  proto static 

Active Internet connections (only servers)

Proto Recv-Q Send-Q Local Address           Foreign Address         State      

tcp        0      0 0.0.0.0:16001           0.0.0.0:*               LISTEN     

tcp        0      0 127.0.0.1:19150         0.0.0.0:*               LISTEN     

tcp        0      0 0.0.0.0:53              0.0.0.0:*               LISTEN     

tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     

tcp        0      0 127.0.0.1:8118          0.0.0.0:*               LISTEN     

tcp        0      0 127.0.0.1:9050          0.0.0.0:*               LISTEN     

/proc/sys/net/ipv4/conf/all/rp_filter: 1

/proc/sys/net/ipv4/conf/default/rp_filter: 1

/proc/sys/net/ipv4/conf/lo/rp_filter: 1

/proc/sys/net/ipv4/conf/tunl0/rp_filter: 1

/proc/sys/net/ipv4/conf/eth0/rp_filter: 1

/proc/sys/net/ipv4/conf/wlan0/rp_filter: 1

/proc/sys/net/ipv4/conf/vboxnet0/rp_filter: 1

# Generated by iptables-save v1.4.6 on Fri Oct 15 20:28:34 2010

*filter

:INPUT ACCEPT [131926:120763757]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [114020:26023937]

COMMIT

# Completed on Fri Oct 15 20:28:34 2010

```

----------

