# difficulty logging in with ssh over adsl link

## Gentree

Hi,

I am trying to log into a remote system with both ends connected to Internet via dynamic IP adsl connections.

I've hit this problem before on these two systems but can't see what I'm forgetting. 

Both PCs have their internal firewalls turned off and connect via ISP provided adsl modem/routers .

Both routers have port 22 open in both directions and NAT settings to forward incoming port 22 traffic to the PC.

Both systems are running sshd. The remote system can shh to the gentoo box but not the other way around. The remote system is running kubuntu.

traceroute to the kbuntu system ends with 

```

16  * * *

17  * * *

18  ge1-1-0-26.bhm-1-dsl.as9105.net (212.74.106.173)  101.435 ms !N * *

```

network not available by std traceroute 

traceroute -p 22  to kubuntu gets all the way but returns no detail after the line above server which is geographically close to the target PC.

```
28  * * *

29  * * *

30  * * *
```

I'm obviously making an assumption and looking straight past the problem . 

Can anyone point out what I'm overlooking?

TIA, Gentree.   :Cool: 

----------

## Jaglover

http://www.canyouseeme.org/

ISP blocking port 22?

----------

## Gentree

thanks, that's a very useful tool. That should make diagnosing the problem easier. 

I'm starting to suspect the problem is the local router firewall. It's Orange livebox mini 2. The web interface is as buggy as shit.  It has managed to insert some rules with no name and now seems unable to delete them. The reset rules button only seems to make things worse and does not in fact reset to factory defaults. 

No idea how to get around that !

 :Mad: 

----------

## Jaglover

Yea ... how those rules got in there ... UPnP? Can UPnP be disabled? Maybe reloading firmware would help.

----------

## Gentree

yeah the firmware sucks.

I think it did not handle a name with a minus:  "ssh-hi" . It's a bug but now it can't delete the entry since it seems it can't search for the empty string to remove it. A mess.

Unfortunately the router is next door and I have to bug the neighbour when this sort of shit happens. Reloading the firmware means resetting the whole config for wifi etc as well , argh!

Orange / FT are the biggest ISP in France, pathetic that they can't write a working web interface.

 :Rolling Eyes: 

They probably sub-contract to some backstreet outfit in New Dehli.

----------

## Gentree

OK , I did a factory reset on the router and that cleared all the crap entries. 

I have now set up firewall and NAT entries for 22 tcp on both boxes and canyouseeme.org confirms access to both machines from outside.

However I still can't connect from gentoo to kubuntu.

```

traceroute -p22 buntybox

traceroute to buntybox (88.106.12.224), 30 hops max, 60 byte packets

 1  livebox (192.168.1.1)  3.624 ms  5.688 ms  10.544 ms

 2  * * *

 3  * * *

 4  * * *

 5  * * *

 6  * * *

 7  * * tengige0-5-0-6.auvtr1.Aubervilliers.opentransit.net (193.251.129.73)  54.109 ms

 8  * * *

 9  * * *

10  * * *

11  * * *

12  * * *

13  * * *

14  * * *

15  * * *

16  * * *

17  * * *

18  * * *

19  * * *

20  * * *

21  * * *

22  * * *

23  * * *

24  * * *

25  * * *

26  * * *

27  * * *

28  * * *

29  * * *

30  * * *

-su-4.0#traceroute -p22 buntybox

```

This route does not even look correct , however I have checked several times the IP 

 :Confused: 

----------

## Jaglover

Try traceroute with TCP packets instead of ICMP?

----------

## Gentree

Isn't that what I did?  :Confused: 

```
traceroute -p22 buntybox 
```

----------

## Jaglover

Traceroute defaults to ICMP, to use TCP you have to specify -T option.

 *Quote:*   

> -p port
> 
>     For UDP tracing, specifies the destination port base traceroute will use (the destination port number will be incremented by each probe).
> 
>     For ICMP tracing, specifies the initial icmp sequence value (incremented by each probe too).
> ...

 

----------

## Gentree

OK, thanks, I must have misread or misunderstood that when I read it. I did not realise it needed -T as well. 

There seems to be some problem with this firewall blocking something. 

It's never very clear what the actual rules being set are when using a web interface but as it stands I have set up firewall rule for port 22 tcp,udp from any source , any mask to any dest any mask.

I set NAT to forward tcp,udp port 22 to my LAN address. 

The port open check shows this port to be open from outside.

The remote can ssh to gentoo but not vice versa.

I have telephone confirmation that the same tool shows 22 to be open and responding on the other machine. 

If I try a traceroute I get nothing but stars beyond the livebox. 

However if I set the firewall from customised to "low" (whatever rules that implies is anyone's guess) I get full output as below:

```
-su-4.0#traceroute -Tp 22 buntybox

traceroute to buntybox (88.106.4.224), 30 hops max, 60 byte packets

 1  livebox (192.168.1.1)  6.174 ms  7.878 ms  8.855 ms

 2  AMontpellier-156-1-149-1.w90-15.abo.wanadoo.fr (90.15.76.1)  45.727 ms  49.842 ms  53.445 ms

 3  10.125.46.10 (10.125.46.10)  56.931 ms  61.047 ms  64.537 ms

 4  ge-2-2-0-0.ncmon102.Montpellier.francetelecom.net (193.253.87.126)  69.148 ms  72.016 ms  76.727 ms

 5  xe-2-0-3-0.nrlyo102.Lyon.francetelecom.net (193.252.103.182)  87.091 ms  91.597 ms  94.572 ms

 6  193.252.161.178 (193.252.161.178)  105.188 ms  103.065 ms  104.628 ms

 7  tengige0-1-0-1.auvtr1.Aubervilliers.opentransit.net (193.251.129.237)  109.460 ms tengige0-1-0-6.auvtr1.Aubervilliers.opentransit.net (193.251.129.241)  51.844 ms tengige0-1-0-7.auvtr1.Aubervilliers.opentransit.net (193.251.129.245)  55.644 ms

 8  tiscali-2.GW.opentransit.net (193.251.254.70)  61.107 ms  51.417 ms  54.696 ms

 9  xe-7-1-0.lon20.ip4.tinet.net (89.149.185.58)  66.554 ms xe-10-3-0.lon20.ip4.tinet.net (89.149.184.45)  58.300 ms  61.349 ms

10  tiscali-uk-gw.ip4.tinet.net (77.67.65.70)  66.557 ms  57.630 ms  61.438 ms

11  * * *

12  ge1-1-0-26.bhm-1-dsl.as9105.net (212.74.106.173)  73.195 ms  66.605 ms  65.731 ms

13  * * *

14  buntybox (88.106.4.224)  105.271 ms  95.857 ms  97.984 ms

```

This seems to imply that the router is blocking some of the communication on port 22. 

Am I over looking something , or maybe misinterpretting what the web interface means?

Thx.

----------

