SSH port forwarding problem NAT/PAT (Livebox) : remote internet access to raspberry pi using SSH

Question

I'm a french student trying desperately to grant access to a raspberry pi using ssh. I'm using :

raspberry : raspberry B+ with raspbian

laptop : ubuntu 18.04

router : livebox 3 (France)

My goal : I want to set up my raspberry pi and my router to enable the use of SSH from a remote network on the internet. I'm perfectly able to access my raspberry via ssh on my local network using both IPv4 and IPv6 address and the command :

sudo ssh pi@192.168.1.30

I tried a lot of different things and found a bunch of tuto all over the internet including on Stack Overflow websites or on YouTube.

I set up my router from an internet browser. The public address of my router is using IPv6 however IPv4 seems required and is enabled on the local network. The following video (in French, sorry) perfectly describe the web pages hosted by the router and how to set it and I followed the instruction without sucess : Youtube video presenting my router set up page

I really struggle with this issue. I created a fixed IP address for the raspberry on the local network, and created a NAT rule with following settings :

When I try to start a ssh connection from the internet, knowing the IP address of my router, I get this :

onyr@kenzae:~$ sudo ssh -p 50050 pi@2a******************* # I use IPv6, and also tried IPv4 without success
[sudo] password for onyr: 
ssh: connect to host 2a********************* port 50050:Connection refused

I obviously not forgot to set up the port I use as external port, here 50050 as open in the IPv6 firewall. I absolutely don't know what to search for next... Pls help.

Post info : Thanks to a helpful user (@Bra1n), I probed the port I want to open, using GRC ShieldsUp!. Here is what I get :

GRC Port Authority Report created on UTC: 2019-04-24 at 09:24:57

Results from probe of port: 50050

1 Ports Tested

1 Ports Open

0 Ports Closed

0 Ports Stealth

THE PORT tested was found to be: OPEN.

TruStealth: FAILED - NOT all tested ports were STEALTH, - NO unsolicited packets were received, - NO Ping reply (ICMP Echo) was received

Apparently, the port I wanted is open, which sounds good. Another idea is to use UFW, here is what I get :

pi@phaeryos:~ $ sudo ufw status verbose
Status: inactive
pi@phaeryos:~ $ sudo ufw enable
Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
Firewall is active and enabled on system startup
pi@phaeryos:~ $ sudo ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere                  
22/tcp (v6)                ALLOW IN    Anywhere (v6) 

Answer 1

You may need a firewall rule on the pi to allow external access. I use UFW to set up my Pi's access rules, check the documentation and examples via a Google search.

Answer 2

The first step to find an error is to reduce complexity. I suggest to temporary disable any firewall until you can connect. Then you can improve your firewall rules step by step.

Another step is to set the destination address phaeryos in the routers port forwarding rule to its ip4 address 192.168.1.30 or its ip6 address. This will reduce complexity with DNS name resolution. If you can connect you can try to set the ip address first to its full qualified DNS name, e.g. phaeryos.myhome.net and then try only with name phaeryos.

I don't know if it matters but I would not mix IPv4 and IPv6 protocol. If you connect with IPv6 to your router you should also use IPv6 addresses in the forward rule and you should test on the local network with ssh pi@*********************.

It should not be necessary to use sudo for ssh.

Because you can ping the outer ip address of the router and the forwarded port is open, you can try to ssh into the RasPi with debug messages enabled using option -v(vv). This will show you more details than Connection refused:

onyr@kenzae:~$ ssh -v -p 50050 pi@2a*******************