Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Ubuntu 12.04 server with a hostnames '' and '', and some IP x.x.x.x, and with fail2ban installed.

On one client computer, I can SSH into my server at,, and user@x.x.x.x. On another client however, I cannot SSH into

Furthermore, upon digging into the server /var/log/ files, there are no logs for the second client attempting to log in via This is also evident in that fail2ban does not ban the second client upon multiple failed password attempts at

Running ssh -vvv on the second client, the last debug message just says that the client is talking to the server - and then is denied.

Is there any way for me to further debug the issue on the server, or something that I'm missing?

Edit: I should also note that the hostname is resolving properly on all machines - ping, nslookup, and wget all appear to work correctly when attempting to resolve

share|improve this question

For easier debugging, set the LogLevel directive in /etc/ssh/sshd_config to Verbose or Debug (it's Info by default)

share|improve this answer

It's hard to tell what the real problem is because you are obfuscating the error messages. They are informative, familiar and less ambiguous than your renditions / interpretations. If you have error messages, provide them when requesting support.

The difference, I take it, lies in where these client machines are located relative to the server. I'm guessing one is inside, while the other is on the outside.

The error ' - and then is denied.' means that the server is not listening on that port. That is to say, the requested TCP port is not bound to a listening socket on the requested interface (IP address). Alternatively it means - client can not reach requested port on x.x.x.x due to a firewall.

You have to:

a. Allow connections originating from the external interface to reach TCP port 22

  • iptables -A INPUT -p tcp --dport ssh -j ACCEPT

b. Configure sshd to listen on all interfaces (default) or on the ip of the external interface.

  • ListenAddress x.x.x.x (/etc/sshd/sshd_config)

If the external interface of your sshd host has a different IP address than what resolves to, thek you have a NAT.

c. Set up Masquerading (NAT) on your router.



echo 1 >/proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o $EXTERNAL -s -j MASQUERADE
iptables -A FORWARD -i $EXTERNAL -o $INTERNAL -m state \
                                   --state RELATED,ESTABLISHED -j ACCEPT

# -m state is deprecated these days so you should probably figure out what the 
# new NAT method is

To get a proper answer, try updating your questions with:

  • real error messages
  • real addresses
  • is x x x x = 10.x.x.x or 192.x.x.x ?
  • is x.x.x.x the address of the interface where sshd is listening? (no need to disclose your full addresses, just hint at the subnets)
  • how do you obtain "properly resolved hostname"?
  • where are your clients (IP)?

ref: Ubuntu iptables

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .