0

When I attempt to connect via SSH from the Pi (client) to another machine (server) on a port other than 22 I get a "No route to host" error message:

Successful SSH

pi@raspberrypi:/opt/pihole $ ssh root@10.0.155.157 -p 22
root@10.0.155.157's password: 
Last login: Fri Jun 14 21:36:23 2019 from raspberrypi
[root@localhost ~]# ^C
[root@localhost ~]# exit

Failed SSH on another port

pi@raspberrypi:/opt/pihole $ ssh root@10.0.155.157 -p 5353
ssh: connect to host 10.0.155.157 port 5353: No route to host
pi@raspberrypi:/opt/pihole $ 

I have confirmed TCP port 5353 is running on the server:

tcp    LISTEN     0      128                                           *:5353  

ARP Entry

pi@raspberrypi:/opt/pihole $ arp -a
? (10.0.155.157) at 00:0c:29:5a:4b:a8 [ether] on eth0

Ping result

pi@raspberrypi:/opt/pihole $ ping 10.0.155.157
PING 10.0.155.157 (10.0.155.157) 56(84) bytes of data.
64 bytes from 10.0.155.157: icmp_seq=1 ttl=64 time=0.564 ms

The TCP packet is not leaving the ethernet interface on the Pi (client), I think it's a local client issue.

pi@raspberrypi:/opt/pihole $ sudo tcpdump -i eth0 host 10.0.155.157
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
07:32:25.397201 IP raspberrypi.47684 > 10.0.155.157.mdns: Flags [S], seq 174219133, win 29200, options [mss 1460,sackOK,TS val 1905316196 ecr 0,nop,wscale 7], length 0
07:32:25.397773 IP 10.0.155.157 > raspberrypi: ICMP host 10.0.155.157 unreachable - admin prohibited, length 68

Version info

pi@raspberrypi:/opt/pihole $ cat /etc/os-release
PRETTY_NAME="Raspbian GNU/Linux 9 (stretch)"
NAME="Raspbian GNU/Linux"
VERSION_ID="9"
VERSION="9 (stretch)"
ID=raspbian
ID_LIKE=debian
HOME_URL="http://www.raspbian.org/"
SUPPORT_URL="http://www.raspbian.org/RaspbianForums"
BUG_REPORT_URL="http://www.raspbian.org/RaspbianBugs"

I have confirmed my firewall is not blocking this connection by explicitly creating an allow rule to permit this traffic despite the fact no logs are showing anything as being blocked. FWIW this box has the cloudflared package installed for DoH. Any ideas on what I might be missing?

1

The problem seems to be a firewall on the server. Your tcpdump shows a response that claims to come from 10.0.155.157, the address of your server.

07:32:25.397201 IP raspberrypi.47684 > 10.0.155.157.mdns: Flags [S], seq 174219133, win 29200, options [mss 1460,sackOK,TS val 1905316196 ecr 0,nop,wscale 7], length 0
07:32:25.397773 IP 10.0.155.157 > raspberrypi: ICMP host 10.0.155.157 unreachable - admin prohibited, length 68

If your privileges on th server allow it, you can verify with tcpdump on the server that the packets arrive and that the unreachable response is sent from the server.

  • Thanks for the idea ran a TCPdump on the server and can confirm traffic is making it to the server. tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on ens192, link-type EN10MB (Ethernet), capture size 262144 bytes 12:02:03.231861 IP raspberrypi.41842 > localhost.localdomain.mdns: Flags [S], seq 469454270, win 29200, options [mss 1460,sackOK,TS val 2007894615 ecr 0,nop,wscale 7], length 0 12:02:03.231900 IP localhost.localdomain > raspberrypi: ICMP host localhost.localdomain unreachable - admin prohibited, length 68 – juanald_reagan Jun 16 at 16:04
  • Stopped the FW on the server and able to connect, thanks! [root@localhost ~]# systemctl stop firewalld – juanald_reagan Jun 16 at 16:17
1

It is a bit confusing for me why a ssh connection to the same ip address 10.0.155.157 on port 22 works and it also should work on port 5353. Usually the ssh daemon (server) listens only on one port. That is by default port 22. So for my understanding the server is listening on this port and not on port 5353. I haven't seen before a ssh daemon listening on two ports at the same time. In man sshd_config you will find:

Port: Specifies the port number that sshd(8) listens on. The default is 22. Multiple options of this type are permitted.

So if you can connect on port 22 then you cannot connect on port 5353 by definition. I suggest to check the settings on your ssh server configuration. It may be possible if you have two ssh daemon running but I don't believe that.

You can also check from the client with

rpi ~$ nmap 10.0.155.157 -p 22
rpi ~$ nmap 10.0.155.157 -p 5353

on what port you can ssh to the server.

  • Sorry for the confusion - the sshd is only running on either 22 or 5353 on the server. When the server is running on 22 the client pi connects just fine. When the server is running on 5353 the pi displays the No route to host issue. I am able to connect to the server on 5353 from other clients on my network which is why I am thinking this is a client issue on the pi, not sure what else to look for/at... – juanald_reagan Jun 16 at 12:10
0

By default, ssh only listens on port 22 for incoming connections.

It is possible to change this port by editing the /etc/ssh/sshd_config configuration file and change the port number from 22 to your desired port.

Then restart sshd with:
sudo service ssh restart

  • Thanks, I checked tcpdump this AM (edited post) and it looks like the connection isn't making it to the interface so I don't think this is a server side issue. Any other ideas on things I should be checking on the client? – juanald_reagan Jun 15 at 11:36
  • From your post and reply thus far, it isn't clear if you have edited the ssh config file. Can you verify? – rprr Jun 15 at 17:49
  • On the server yes, on the client no. – juanald_reagan Jun 15 at 18:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.