2

After running for a few hours, my local Raspberry Pi 3 refuses ssh connections, the green LED is lighting up sporadically:

Starting Nmap 7.40 ( https://nmap.org ) at 2018-08-13 10:01 
Nmap scan report for 
Host is up.
PORT   STATE    SERVICE
22/tcp filtered ssh

Only after rebooting the Raspberry Pi am I able to connect via ssh again:

Starting Nmap 7.40 ( https://nmap.org ) at 2018-08-13 10:05
Nmap scan report for 
Host is up (0.047s latency).
PORT   STATE SERVICE
22/tcp open  ssh

Power management on the wlan0 interface is disabled:

$ iwconfig wlan0
wlan0     IEEE 802.11  ESSID:
          Mode:Managed  Frequency:2.432 GHz  Access Point:
          Bit Rate=72.2 Mb/s   Tx-Power=0 dBm
          Retry short limit:7   RTS thr:off   Fragment thr:off
          Power Management:off
          Link Quality=45/70  Signal level=-65 dBm  
          Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
          Tx excessive retries:0  Invalid misc:0   Missed beacon:0

These are the iptables rules:

$ sudo iptables -vnL
[sudo] password for root: 
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  124 10420 ACCEPT     tcp  --  wlan0  *       192.168.0.0/24       0.0.0.0/0            tcp dpt:22
   60  7126 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
    2   168 ACCEPT     all  --  lo     *       127.0.0.1            127.0.0.1           
    6   702 ACCEPT     all  --  eth0   *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy DROP 13 packets, 1084 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   77  9253 ACCEPT     tcp  --  *      wlan0   0.0.0.0/0            192.168.0.0/24       tcp spt:22
    4   392 ACCEPT     all  --  *      lo      127.0.0.1            127.0.0.1           
   62  6600 ACCEPT     tcp  --  *      eth0    0.0.0.0/0            0.0.0.0/0           
   10  1038 ACCEPT     udp  --  *      eth0    0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     tcp  --  *      wlan0   0.0.0.0/0            0.0.0.0/0            multiport dports 21,22,25,80,110,123,143,443,465,993,995
   18  1158 ACCEPT     udp  --  *      wlan0   0.0.0.0/0            0.0.0.0/0            multiport dports 53,67

A few times already, I was able to reconnect after scanning all ports. But that fails sometimes.

On another occasion, I was still logged in via ssh overnight. Next morning, I logged out and, as expected, immediately afterwards wasn't able to login again.

Any hints on what could be causing this behavior?

  • Your nmap output is a bit odd -- it's reporting the port as filtered, meaning "a firewall, filter, or other network obstacle is blocking the port". If sshd just weren't running, it would say closed. I doubt it is the iptables rules on the pi as they look to be a bit pointless (other than dropping outgoing ICMP packets, they don't do anything, correct me if I am wrong). In any case, your problem is probably a firewall. – goldilocks Aug 13 '18 at 11:42
  • @goldilocks You mean the firewall on the client side? But how does that explain, that I can suddenly reconnect after I've rebooted the Raspberry Pi? – typo Aug 13 '18 at 11:48
  • I don't know. I'd have a read through this, looking at the parts which describe how "filtered" is reported. It could be that blocking outbound ICMP packets does that. You really should just get rid of the iptables firewall stuff on the pi side. What you have now is at best pointless and at worst bound to cause confusion because of the ICMP thing. – goldilocks Aug 13 '18 at 12:01
  • @goldilocks Thank you for the hint regarding ICMP, that sounds very much like it. I will try it out later. The Raspberry Pi is meant to be a sync server, but haven't gotten around that yet due to this problem, so the iptables isn't complete yet. – typo Aug 13 '18 at 12:46
  • 1
    It would be a fairly simple test to disable iptables to see if the issue persists. If the issue "goes away", you've likely found the problem. – Seamus Aug 13 '18 at 15:18
1

After enabling logging of iptables, I saw that the outgoing UDP packets of ntp on port 123 were being denied:

iptables denied: IN= OUT=wlan0 [...] PROTO=UDP SPT=123 DPT=123

After adding port 123 to the outgoing UDP rule

[...] multiport dports 53,67,123

the Raspberry Pi 3 no longer refuses SSH connections.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.