I have an SSH server behind a NAT router. Machines on the same (NAT'd) network as the SSH server can only connect to the SSH server using the LAN IP, not the WAN IP. Why?
My network looks like this:
(the Internet, via Comcast)
|
| (cable line)
comcast modem. ← External IP of a.b.c.d,
| internal IP of 10.1.10.1 on 10.1.10.0/24
|
|
box running sshd (10.1.10.201)
I run an SSH service behind a Comcast router performing NAT. Using the IP address obtained above, I can run ssh me@«that IP»
from anywhere on the Internet, and I receive my SSH service. If I run that same command from within the 10.1.10.0/24 network just inside the router, the connection will time out.
The Comcast router is set up to do port forwarding to the SSH machine on the standard port.
- The comcast router answers pings, both on the internal and external IPs.
- The box running
sshd
answers pings
The device is a piece of junk SMC Networks SMCD3G.
Performing a wireshark on the sshd
machine, while attempting to ssh 10.1.10.201
gives normal looking traffic. Attempting an ssh a.b.c.d
gives the following:
Source Destination Info
10.1.10.11 10.1.10.201 39946 > ssh [SYN] Seq=0 Win=14600 Len=0 MSS=1460
10.1.10.201 10.1.10.11 ssh > 39946 [SYN, ACK] Seq=0 Ack=1 Win=5792 Len=0
10.1.10.11 10.1.10.201 39946 > ssh [RST] Seq=1 Win=0 Len=0
10.1.10.11 10.1.10.201 39946 > ssh [SYN] Seq=0 Win=14600 Len=0 MSS=1460
10.1.10.201 10.1.10.11 [TCP Previous segment lost] ssh > 39946 [SYN, ACK] Seq=46941561
10.1.10.11 10.1.10.201 39946 > ssh [RST] Seq=1 Win=0 Len=0
(the last three lines repeat)
The packets seem to be getting there, but the connecting machine is sending a RST. Why?
From the client's side (the machine running SSH) a later attempt looked like:
Source Destination Info
10.1.10.11 a.b.c.d 40212 > ssh [SYN] Seq=0 Win=14600 Len=0 MSS=1460
10.1.10.201 10.1.10.11 ssh > 40212 [SYN, ACK] Seq=0 Ack=1 Win=5792 Len=0 MSS=1460
10.1.10.11 10.1.10.201 40212 > ssh [RST] Seq=1 Win=0 Len=0
10.1.10.11 a.b.c.d [TCP Retransmission] 40212 > ssh [SYN] Seq=0 Win=14600 Len=0 MSS=1460
10.1.10.201 10.1.10.11 [TCP Previous segment not captured] ssh > 40212 [SYN, ACK] Seq=15635206
10.1.10.11 10.1.10.201 40212 > ssh [RST] Seq=1 Win=0 Len = 0
(the last three lines repeat)
The only thing that stands out is that I'm continually getting "Previous segment not captured" (it wasn't? Seems to be right there), and that the sequence numbers from the client are really deterministic. (Aren't they supposed to start at a random point, and increment from there?)