2

I read some tutorials here on connecting to my Pi via SSH. I have successfully done this over my own network. I am trying to do it from the internet (I use my phone's hotspot to attempt from outside my network), but I have had no success.

I have verizon fios, and although I do not have an official static IP address, it rarely changes (i've never seen it change in over a year) so I was just going to connect using my IP address versus setting up my own free DNS.

I am thinking I may just be misunderstanding port forwarding; here's what I did:

I made a new rule for my static raspberry pi address, saying to listen to any port, and forward to port 22 on the pi.

I use putty to attempt to connect by typing in my IP address and using port 22.

Some direction on this would be appreciated... I've been at it for hours.

15
  • I forgot to mention, when I go to yougetsignal.com/tools/open-ports it says my port 22 is closed. Sep 2, 2014 at 5:28
  • (Sorry, I cannot 'comment' so I'll have to 'answer'). Could you please elaborate a little more on where you configured that port forwarding of yours? It's got to be in the WAN-connecting router of course. If you do not trust the port forwarding of this device maybe setup a simple server (ssh, web or ftp) on a laptop or desktop machine to verify. Besides the forwarding of the ssh relevant port 22 you will need no further settings concerning listening or whatever. If you suspect the Pi's sshd to fail you should be looking in that matter too. Obviously you should be checking to connect to it on y
    – Ghanima
    Sep 2, 2014 at 6:50
  • Ok, so everything does work fine when I connect inside the network. Ill try my best to elaborate here. I will start by saying that the problem probably is with me; I am a new pi owner, and I have never remotely connected to anything before... So thanks in advance! ssh status is running... From uname -a: raspberrypi 3.12.22+ #691 PREEMPT Wed Jun 18 18:29:58 BST 2014 armv6l GNU/Linux Sorry, the journalctl came back as command not found; like I said, I am new to the pi and linux. My pi has a static IP that I assigned to it. Again, it works fine on the LAN. Sep 2, 2014 at 7:22
  • 1
    Sorry, just to clear things up - do you have a connection from your pi to the internet? What does ping verizon.com tell you run on the pi?
    – Bex
    Sep 2, 2014 at 7:44
  • 1
    Yeah I am not sure how to fix that... or if its abnormal. If I ping something in my network, it works, if I ping a website, it says Network unavailable. the pi is connected vis ethernet to the internet. When I loaded it earlier into the GUI, I could surf the web. Sep 2, 2014 at 7:56

3 Answers 3

3

Obviously, the problem seems to be either the port forwarding configuration, or the ability for the SSH server/RPi to handle external connections.

Port forwarding configuration

Maybe you should try with a specific external port. Let's say 10022 (external port) forward to your RPi IP address, port 22. Then from an external IP address, try telnet <your IP address> 10022. If you have a message similar to this:

$ telnet <your IP address> 10022
Trying <your IP address>...
Connected to <your IP address>.
Escape character is '^]'.
SSH-2.0-OpenSSH_6.6.1p1 Debian-7

...then, the port forwarding works well. Otherwise, you should try another server with another server, just to make sure your SSH server does not reject external connections.

iperf

I like to use iperf to make sure my device is reachable from my external network. This software allows you to test the bandwidth performances and, maybe it is not the fastest way, but it is lightweight and easy to use :-)

Install it from your RPi (sudo apt-get install iperf), then run iperf -s. The default listening port is 5001. So you will have to define another port forwarding (external port 5001 -> <RPi IP address>, port 5001). From an external IP address, run telnet <your IP address> 5001.

$ telnet <your IP address> 5001
Trying <your IP address>...
Connected to <your IP address>.
Escape character is '^]'.

If you see a similar message, then the port forwarding configuration works well. Otherwise, you should tweak your router...

SSH server configuration

If none solution of the above worked, the problem is probably in the SSH server or RPi configuration.

netstat

We will make sure the SSH server listens for every hosts. Run sudo netstat -anp | grep ssh. You see the 0.0.0.0 part of the following line? It says "I [the SSH server] will listen the port 22 but only for the hosts matching 0.0.0.0" (0.0.0.0 means "every hosts"). If you don't see it, the problem is SSH server configuration (see next section):

tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      21985/sshd

/etc/ssh/ssh_config

Please copy/paste the result of cat /etc/ssh/ssh_config in the comment section.

/etc/hosts.deny & /etc/hosts.allow

You can also have a look in the following files /etc/hosts.deny & /etc/hosts.allow. Please copy/paste the result of cat /etc/hosts.deny & cat /etc/hosts.allow in the comment section.

4
  • Host * #ForwardAgent no #ForwardX11 no #ForwardX11Trusted yes #RhostsRSAAuthentication no #RSAAuthentication yes #PasswordAuthentication yes #HostbasedAuthentication no #GSSAPIAuthentication no #GSSAPIDelegateCredentials no #GSSAPIKeyExchange no #GSSAPITrustDNS no #BatchMode no #CheckHostIP yes #AddressFamily any #ConnectTimeout 0 #StrictHostKeyChecking ask #IdentityFile ~/.ssh/identity #IdentityFile ~/.ssh/id_rsa #IdentityFile ~/.ssh/id_dsa Sep 2, 2014 at 20:27
  • #Port 22 #Protocol 2,1 #Cipher 3des #Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc #MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160 #EscapeChar ~ #Tunnel no #TunnelDevice any:any #PermitLocalCommand no #VisualHostKey no #ProxyCommand ssh -q -W %h:%p gateway.example.com SendEnv LANG LC_* HashKnownHosts yes GSSAPIAuthentication yes GSSAPIDelegateCredentials no Sep 2, 2014 at 20:27
  • I will start trying all the other things you said. Thank you very much for the explanations Sep 2, 2014 at 20:28
  • @JonathanAdams Well, my /etc/ssh/ssh_config file is very similar. What about the ~/.ssh/config file? Sep 3, 2014 at 7:08
2

Most likely the problem is your ISP, check if your ISP blocks port 22 for security reasons (mine does). Change the port to, for example 2222, portforward port 2222 on your router and try again.

ssh pi@yourpublicIPgoeshere -p 2222

do note: your ISP might also have a router installed in your home, in that case you need to forward port 2222 (or any port you want to forward) to the personal router's IP.

Again, this is also the case for me, I need to use a web portal my ISP provides to portforward on it.

addition:

sudo nano /etc/ssh/sshd_config

change the port number

service ssh restart

then check if the port is open/usable

As a sidequestion: did you have a router provided by your ISP?

2
  • Now what I have been trying is other ports for the router to listen to (2233), but I am still trying to forward to port 22 on the pi. Would the ISP be blocking that? Sep 3, 2014 at 10:27
  • To avoid confusion I would also let the pi listen to the new ssh port, but isps cant block your own router ports
    – Havnar
    Sep 3, 2014 at 10:29
0

I wanted to thank you all for your help. The issue ended up being my gateway IP being 0.0.0.0. Once I changed it back, everything worked fine. I have no idea how that got messed up, because I did connect to the internet when I first got it.

Anyways, thanks again!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.