2

I'm a french student trying desperately to grant access to a raspberry pi using ssh. I'm using :

raspberry : raspberry B+ with raspbian

laptop : ubuntu 18.04

router : livebox 3 (France)

My goal : I want to set up my raspberry pi and my router to enable the use of SSH from a remote network on the internet. I'm perfectly able to access my raspberry via ssh on my local network using both IPv4 and IPv6 address and the command : 

sudo ssh pi@192.168.1.30

I tried a lot of different things and found a bunch of tuto all over the internet including on Stack Overflow websites or on YouTube.

I set up my router from an internet browser. The public address of my router is using IPv6 however IPv4 seems required and is enabled on the local network. The following video (in French, sorry) perfectly describe the web pages hosted by the router and how to set it and I followed the instruction without sucess : Youtube video presenting my router set up page

I really struggle with this issue. I created a fixed IP address for the raspberry on the local network, and created a NAT rule with following settings : the configuration of the NAT rule

When I try to start a ssh connection from the internet, knowing the IP address of my router, I get this : 

onyr@kenzae:~$ sudo ssh -p 50050 pi@2a******************* # I use IPv6, and also tried IPv4 without success
[sudo] password for onyr: 
ssh: connect to host 2a********************* port 50050:Connection refused

I obviously not forgot to set up the port I use as external port, here 50050 as open in the IPv6 firewall. I absolutely don't know what to search for next... Pls help.

Post info : Thanks to a helpful user (@Bra1n), I probed the port I want to open, using GRC ShieldsUp!. Here is what I get :

GRC Port Authority Report created on UTC: 2019-04-24 at 09:24:57

Results from probe of port: 50050

1 Ports Tested

1 Ports Open

0 Ports Closed

0 Ports Stealth

THE PORT tested was found to be: OPEN.

TruStealth: FAILED - NOT all tested ports were STEALTH, - NO unsolicited packets were received, - NO Ping reply (ICMP Echo) was received

Apparently, the port I wanted is open, which sounds good. Another idea is to use UFW, here is what I get : 

pi@phaeryos:~ $ sudo ufw status verbose
Status: inactive
pi@phaeryos:~ $ sudo ufw enable
Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
Firewall is active and enabled on system startup
pi@phaeryos:~ $ sudo ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere                  
22/tcp (v6)                ALLOW IN    Anywhere (v6)
|improve this question
  • Your ISP may block those ports upstream from you. – Brick Apr 23 '19 at 20:06
  • You can check using grc.com's Shields Up to probe the requisite port – Bra1n Apr 24 '19 at 7:49
  • I did what you asked, apparently the port I want to use is OPEN, which sounds good. I continue my investigation – Onyr Apr 24 '19 at 9:32
1

You may need a firewall rule on the pi to allow external access. I use UFW to set up my Pi's access rules, check the documentation and examples via a Google search.

|improve this answer
  • I tried this using sudo ufw allow ssh with no success. – Onyr Apr 23 '19 at 19:59
  • From the perspective of the Pi, I think there should be no difference between internal and external traffic. If the port forwarding is successful, the Pi will still be addressed by the router using the Pi's internal IP address. – Brick Apr 23 '19 at 20:04
  • From what I can understand, the problem seems to be linked to the router and not to the raspberry pi. – Onyr Apr 23 '19 at 20:09
  • What's the output from "sudo ufw status verbose" ? – Bra1n Apr 24 '19 at 7:43
  • When tipping this command on the raspberry shell : ~ $ sudo ufw status verbose Status: inactive – Onyr Apr 24 '19 at 9:06
0

The first step to find an error is to reduce complexity. I suggest to temporary disable any firewall until you can connect. Then you can improve your firewall rules step by step.

Another step is to set the destination address phaeryos in the routers port forwarding rule to its ip4 address 192.168.1.30 or its ip6 address. This will reduce complexity with DNS name resolution. If you can connect you can try to set the ip address first to its full qualified DNS name, e.g. phaeryos.myhome.net and then try only with name phaeryos.

I don't know if it matters but I would not mix IPv4 and IPv6 protocol. If you connect with IPv6 to your router you should also use IPv6 addresses in the forward rule and you should test on the local network with ssh pi@*********************.

It should not be necessary to use sudo for ssh.

Because you can ping the outer ip address of the router and the forwarded port is open, you can try to ssh into the RasPi with debug messages enabled using option -v(vv). This will show you more details than Connection refused:

onyr@kenzae:~$ ssh -v -p 50050 pi@2a*******************
|improve this answer
  • Thank you for the support. Unhappily, I'm a student without access to my home router and will have to wait several months to go back to my work. I will continue to learn routing in the meanwhile. – Onyr May 1 '19 at 9:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.