up vote 2 down vote favorite
share [g+] share [fb]

I have the SSH server listening on my IP address in the guest machine (debian2)

edarabos@debian2:~$ telnet 172.16.100.128 22
Trying 172.16.100.128...
Connected to 172.16.100.128.
Escape character is '^]'.
SSH-2.0-OpenSSH_5.5p1 Debian-6
^]
telnet> close
Connection closed.

I can reach the host OS with ping.

edarabos@debian2:~$ ping -c 1 172.16.100.1
PING 172.16.100.1 (172.16.100.1) 56(84) bytes of data.
64 bytes from 172.16.100.1: icmp_req=1 ttl=128 time=0.243 ms

--- 172.16.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.243/0.243/0.243/0.000 ms

The host computer provides me with fine NAT (which I really need):

edarabos@debian2:~$ ssh computer.faraway.hu
                  !!! UTF-8 !!!                0mm
                                            (|)-(|)
#######     ########## ##########  #########################
edarabos@computer.faraway.hu's password:
Linux computer 2.6.32-5-amd64 #1 SMP Tue Jun 14 09:42:28 UTC 2011 x86_64
You have mail.
Last login: Thu Sep  1 14:33:27 2011 from 257.257.257.257
 16:13:49 up 2 days, 21:14,  5 users,  load average: 0.00, 0.02, 0.00
edarabos@computer:~$

(edited for privacy)

My interface and routing configuration:

edarabos@debian2:~$ /sbin/ifconfig eth0 | grep "inet addr"
          inet addr:172.16.100.128  Bcast:172.16.100.255  Mask:255.255.255.0
edarabos@debian2:~$ /sbin/route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
172.16.100.0    0.0.0.0         255.255.255.0   U     0      0        0 eth0
0.0.0.0         172.16.100.1    0.0.0.0         UG    0      0        0 eth0

When I try to use PuTTY to SSH to the guest OS (172.16.100.128) I get "Network error: Connection refused.". Doing tcpdump -vv on the guest shows nothing when trying. It shows things when I SSH out to computer.faraway.hu.

The host is Win 7 32bit, VMWare Workstation 7.1.1. The guest is Debian Squeeze with non-tweaked kernel 2.6.32.

Google did not helped and I'm out of ideas.

UPDATE

I have a Cygwin on my Windows host and I have SSH on it which says:

$ ssh -vvv 172.16.100.128
OpenSSH_5.8p1, OpenSSL 0.9.8r 8 Feb 2011
debug1: Reading configuration data /home/edarabos/.ssh/config
debug2: ssh_connect: needpriv 0
debug1: Connecting to 172.16.100.128 [172.16.100.128] port 22.
debug1: connect to address 172.16.100.128 port 22: Connection refused
ssh: connect to host 172.16.100.128 port 22: Connection refused

UPDATE

Using telnet from host to guest:

C:\Users\edarabos>telnet 172.16.100.128 22
Connecting To 172.16.100.128...Could not open connection to the host, on port 22: Connect failed

Also, firewall service is not running on host. On the guest iptables -L is empty and all policy is ACCEPT.

UPDATE

I also configured a host-only VMnet and added a network interface to the guest accordingly. This interface (eth1) gets a proper IP address from the DHCP server on that VMnet. When I try to PuTTY from the host to that IP adress I get connection timeout. I also cannot ping the guest from the host.

I installed another guest with the same settings (cloned the first one). I can do SSH between the two guests. (The IPs of guests on that network are 172.16.101.2 and 172.16.101.3).

link|improve this question
100% accept rate
What port are you trying to connect to with PuTTY's SSH? 22 is clearly a working OpenSSH listener, so connection refusal doesn't add up. – Shane Madden Sep 1 '11 at 14:47
To port 22, I agree. :-( – Notinlist Sep 1 '11 at 15:00
What does ssh with the "-v" option say? – cjc Sep 1 '11 at 16:10
I have Windows on the host, but fortunately I have a Cygwin under it. Updated the post. – Notinlist Sep 2 '11 at 8:36
I believe that the telnet command you ran and showed us the output of was run from inside the Guest. Could you test that from the host to ensure the host can get to port 22 on the guest? – ayaz Sep 3 '11 at 12:36
show 8 more comments
feedback

migrated from serverfault.com Sep 3 '11 at 12:13

This question came from our site for system administrators and desktop support professionals.

4 Answers

up vote 2 down vote accepted
+100

Is sshd listening on 172.16.100.128 on the guest (linux) machine? -> grep Listen /etc/ssh/sshd.conf

[forget the above]

Summary:

The host OS only sees the outside interface of the NATted network, so you need to set up port forwarding to the NATted network in order to access one of the NATted hosts in that network, as there could be many hosts in there hidden behind one IP. (As is the case with any NATted network.)

link|improve this answer
Why the hack don't you all read? "The host is Win 7 32bit, VMWare Workstation 7.1.1. The guest is Debian Squeeze with non-tweaked kernel 2.6.32." – Notinlist Sep 7 '11 at 11:38
computer.faraway.hu is a computer far away in Hungary. It does not matter. It is an example to demonstrate that the guest machine can access the Internet via NAT. To be clear: There is no such computer. See the "(edited for privacy)" note! Read! – Notinlist Sep 7 '11 at 11:40
Alright I edited my question. Even though I mixed your machines, the question essentially stays the same. – Marki Sep 7 '11 at 11:43
It is listening on all interfaces (*:ssh (LISTEN) in output of lsof). The output of your grep is two commented lines. – Notinlist Sep 7 '11 at 11:56
Forget my question. Oh well, I guess you should try setting up a port forwarding to the guest too, since the NATted network is hidden behind the one IP address... It's like accessing your PC at home (behind a router) from the Internet, you need to forward ports. vmware.com/support/ws55/doc/ws_net_nat_advanced.html – Marki Sep 7 '11 at 11:57
show 4 more comments
feedback
up vote 1 down vote

Check your firewall settings on the target server - they may be blocking port 22.

link|improve this answer
Firewall service is not running on host. On the guest iptables -L is empty and all policy is ACCEPT. – Notinlist Sep 5 '11 at 13:23
feedback
up vote 0 down vote

Run a packet capture from the client and the server. You won't be able to see the contents of the packets, but you can see the session being setup. On the server side, verify that you see traffic from the client and that the server responds. If the server responds, verify that you get the response back from the same IP:port that you connected to. Verify IP:port combinations on both sides.

Other things to look at:

  • hosts.allow/hosts.deny
  • server logs (specifically anything relevant to SSH or client)
  • verify that sshd is binding to an IP that is accessible
  • verify netmask on both sides
link|improve this answer
Can you recommend a packet capturing software that would work in such environment under Windows7? On the server (guest) side the tcpdump is silent, see the paragraph under example 4. – Notinlist Sep 7 '11 at 11:44
About the dotted list. #1 All default. #2 Silence. #3 See example 1 and update 3 paragraph 2. #4 On guest side they are correct. On host side: How can I do that? – Notinlist Sep 7 '11 at 11:47
feedback
up vote 0 down vote

What machine is running which OS? To quote from your question:

edarabos@debian2:~$ telnet 172.16.100.128 22
Trying 172.16.100.128...
Connected to 172.16.100.128.
Escape character is '^]'.
SSH-2.0-OpenSSH_5.5p1 Debian-6
^]

So a Debian box (VM?) is telnetting to another Debian box (running SSH-2.0-OpenSSH_5.5p1 Debian 6)? What happened to the Windows box that you claim is the host (physical) system? I think you're telnetting from the Debian box to itself, not the host. What is the IP address of the host on the virtual LAN between guest and host?

link|improve this answer
Yes. I am telnetting from the Debian box to itself. And it was my intention to say. The key is in the previous sentence that you did not quote: "I have the SSH server listening on my IP address in the guest machine (debian2)" <= Guest machine is debian2. This example just shows that the SSH server is running and listening on that IP. – Notinlist Sep 7 '11 at 8:35
I have two WMnets configured. One: A NAT where the gateway IP is 172.16.100.1. Two: Host-only interface where there is no IP related to the host can be configured. – Notinlist Sep 7 '11 at 8:38
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.