Firewall on SSH server is refusing connection from my client (it works fine without firewall enabled)

Question

I have an SSH server I would like to connect to from my Android.

I created SSH keys and everything is working fine. My cellphone connects to my server via SSH. No problem there.

The problem starts when I enable my iptables firewall. At this point, my firewall is refusing connections coming from my Android.

On my Android I'm using Termux. When in Termux, I can find my public IP address with

curl -4 icanhazip.com

It says my public IP for my Android is x.x.121.3. I obfuscated the address here but in the actual iptables configuration it is exact. This is the configuration:

Chain INPUT (policy DROP 7530 packets, 338K bytes)
 pkts bytes target     prot opt in     out     source               destination         
    3   180 ACCEPT     tcp  --  *      *       x.x.161.85           0.0.0.0/0            tcp dpt:22 state NEW
    1    60 ACCEPT     tcp  --  *      *       x.x.134.54           0.0.0.0/0            tcp dpt:22 state NEW
    0     0 ACCEPT     tcp  --  *      *       x.x.121.3            0.0.0.0/0            tcp dpt:22 state NEW
    0     0 ACCEPT     tcp  --  *      *       x.x.136.182          0.0.0.0/0            tcp dpt:22 state NEW
  857 4470K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
   12   986 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  650 81372 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW,RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0

What am I doing wrong? How to allow SSH connections coming from my cellphone?

Answer 1

curl -4 icanhazip.com uses HTTP and port 80 to retrieve data. You can verify this by running curl -v -4 icanhazip.com.

It may be your ISP manipulates traffic, so any connection you make to the port 80 enters the Internet from a different IP address than your other communication (including SSH to port 22).

E.g. they may route HTTP from many of their clients through a single proxy server, to make advantage of cache and reduce data transfer through the link beyond the proxy. The proxy is almost transparent: it requires no configuration on your end and you "feel" as if there was no proxy; but it performs HTTP requests on behalf of many clients, using its separate IP address. In effect all the clients appear to HTTP servers as coming from this single IP address.

Whatever really happens, probably the address curl gave you is not the source address your SSH connections use. The address you allowed in the firewall is not the right one.

It's fortunate you can disable the firewall and connect successfully. Use this fact to discover the right IP address:

1. Disable the firewall temporarily.
2. Connect from the cellphone.
3. In the resulting shell session run echo "$SSH_CONNECTION".
4. The first IP address is the one the server "thinks" you connect from.

5. If echo … prints nothing then check logs on the server for the actual IP of the client. In my Debian some useful commands are:

   sudo tail /var/log/auth.log
   journalctl _SYSTEMD_UNIT=ssh.service | tail
   

   Or use some tool (lsof, ss, …) to see established connections and associated addresses; the SSH connection you're using should be there. I will not elaborate here on how to narrow the list and actually find this single connection.

After you discover the right address, reconfigure the firewall to allow SSH traffic originating from it.