0

Something very strange happened 4 days ago....

I have been remotely connecting to my workstation using ssh. I use public authentication and my router has been set up to port forward all connections on external/public port 4444 to port 22.

I'm using the dynamic dns service noip.

Something very strange happened 4 days ago. my ssh from my remote laptop started timing out. after further analysis I realized that the noip domain public ip address was wrong, and somehow the noip software stopped working. After fixing that up, I still cannot connect to my workstation through ssh... the error is 'connection timed out'.

I can ping my domain name remotely(outside network) with no problems, and I can connect to my ssh server if my remote computer is in the same network as my ssh server. Yet it times out outside of the network.

Also while I have only port fowarded port 4444, when I check what ports are open on my router using an online port forwarding tool (or unix nmap command outside of the network), I notice that almost ALL of my ports are open! I definitely did not open these ports through my router settings... heck even port 443 is open... a port which my ISP does not allow me to open...

Wtf could be going on? has my DNS been hacked? I checked my server ssh logs (in /var/log/auth.log) and there is no mention of my remote computer (outside network) even trying to logon to my openssh server.

Even though (via nmap and online port checking tools) my ports are open, ssh still cannot connect via port 4444 or port 22 remotely, outside of the network)

What should I do? I'm totally baffled

Improve this question
9
  • Apparently the port scan is inaccurate. You said the dynamic DNS service acted up - it looks like that is where to look for issues then. Have you tried connecting from a different computer? Tried flushing your DNS cache? Tried connecting using the IP address directly?
    – Appleoddity
    Dec 9, 2018 at 23:22
  • a) why dont you check what servers are running on your machine. b) maybe your NAT router put you into a so-called DMZ so all ports get forwarded to your IP
    – barlop
    Dec 9, 2018 at 23:57
  • @Appleoddity yes I did try from a different pc, same issue. I did try and connect to ip address directly and same problem occurs.
    – tristo
    Dec 10, 2018 at 0:20
  • @barlop when I use nmap on 192.168.1.1/localhost, all ports except 4444 are closed, also on the same network, when I use my domain name, all ports are closed BUT when I use nmap from outside of the network, it says all ports are open, does this give any clues?
    – tristo
    Dec 10, 2018 at 0:42
  • @tristo for a port2 be open a server has to be running on there.If a server isn't running on that port and it is showing as open then maybe there is something very strange about that router like it makes it look as if a server is running from the router on that port.What if you try to make a raw connection to the port so (not sure if i have the syntax right, but) nc ip port or telnet ip port Then is it just blank or does it say any kind of description of what server is allegedly on there? Also, try opening the port on the router, does nmap(from outside) and other scanners then say closed?
    – barlop
    Dec 10, 2018 at 12:28

1 Answer 1

Reset to default
0

Did you check that the IP address provided through the DNS service matches the external ip-address of your router?

If they match your router is acting up or is hacked. Reset the router to factory default, (re-)flash the latest router firmware (to make sure you have the latest security patches) and reconfigure it.
Keep an eye on it. If it starts acting up again it is time to buy another router (from another brand), because you can't trust (it's unreliable or easily hacked) this one.

If the DNS and IP don't match the dynamic DNS service is acting up. Re-register your router with the dynamic DNS service and all should be well. (Give the DNS systems a couple of hours to settle though. Not every DNS service synchronizes quickly so it may take a while for the latest DNS changes to propagate everywhere.)

Improve this answer
3
  • when I use nmap on 192.168.1.1/localhost, all ports except 4444 are closed, also on the same network, when I use my domain name, all ports are closed BUT when I use nmap from outside of the network, it says all ports are open, does this give any clues? I'm new to networking and so I have a tendency to think the worst and think that someone has hacked the router
    – tristo
    Dec 10, 2018 at 0:42
  • The router appears to be ‘open’. That isn’t normal. Everything should be closed except those ports you have explicitly opened by configuring port-forwarding. 3 possibilities: 1 router is seriously misconfigured. 2 router is hacked. 3 router has very sloppy firmware.
    – Tonny
    Dec 10, 2018 at 7:46
  • @Tonny You wrote "3 possibilities: 1 router is seriously misconfigured. 2 router is hacked. 3 router has very sloppy firmware." <--- So thatos what you said, but from what the questioner has just said 8h ago, it is none of those 3 possibilities you mention(or any of his computers). He said that even when he turns his router off, ports still show as open.
    – barlop
    Dec 10, 2018 at 23:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .