I often have to use my company's VPN to access corporate sites - but I'd like to be able to access my machines on my LAN without having to disconnect from VPN.
Previously, my approach has been:
- Configure my LAN router to forward an external port to the ssh port on a local machine
- Configure a domain name to always point at my LAN's public IP
ssh -p <external_port> <domain>
and that's worked fine. Recently, however (in the last ~2 days), this approach has failed -
ssh -vvv ... hangs at
debug1: Connecting to <domain> port <external_port> for about 30 seconds, and then prints
ssh: connect to host <domain> port <external_port>: Operation timed out. Trying to ssh to the IP directly gives a similar result. If I'm not connected to the VPN, however, I can still ssh to that domain as expected.
Here's what I've tried:
- I've confirmed that
<domain>points at the correct IP:
$ curl http://ifconfig.co/json | grep '"ip"' # From a machine on my local network "ip": "<ip>" $ dig <domain> | grep -A 1 'ANSWER SECTION' ;; ANSWER SECTION: <domain>. 600 IN A <ip>
- I've confirmed (visually, from my router's UI) that
<external_port>is correctly forwarded to the appropriate internal IP and port (is there a way to confirm that programmatically?). I've restarted the router in case there was some latent issue. The router is a Google Wifi router.
- While on VPN, I've tried Tracing a Route to the domain. Here's the output (from Mac OS' Network Utility:)
Traceroute has started… traceroute to <domain> (<ip>), 128 hops max, 72 byte packets 1 freeip.amazon.com (10.85.80.141) 9.752 ms 13.708 ms 13.822 ms 2 freeip.amazon.com (10.40.1.108) 22.153 ms 14.089 ms 22.384 ms 3 freeip.amazon.com (10.40.1.40) 17.305 ms 36.349 ms 34.767 ms 4 10.40.1.25 (10.40.1.25) 12.462 ms 23.093 ms 11.888 ms 5 sfo8-8-np-edg-fw1.amazon.com (10.40.1.30) 12.816 ms 14.120 ms 11.842 ms 6 10.40.1.34 (10.40.1.34) 23.566 ms 9.135 ms 28.704 ms 7 * * * 8 * * * 9 * * * 10 * * * 11 * * * 12 * * * 13 * * * 14 * * * 15 * * * 16 * * * 17 * * * 18 * * * 19 * * * 20 * * * 21 * * * 22 * * * ...
A friend's Linux box (from outside my LAN, but not on my work's VPN) gets a similar "infinite hang" when trying to trace a route to my IP, so I know it's not specific to the VPN.
- I also tried pinging the domain, and consistently got timeouts:
$ ping <domain> PING <domain> (<ip>): 56 data bytes Request timeout for icmp_seq 0 Request timeout for icmp_seq 1 Request timeout for icmp_seq 2 Request timeout for icmp_seq 3 Request timeout for icmp_seq 4 Request timeout for icmp_seq 5
- The day that I noticed that I was no longer able to connect was the same day that I installed a pi-hole on my home LAN. I don't think this is the cause (and another, more network-knowledgable friend agrees) - but, just in case, I disabled the pi-hole 2 days ago, and this behaviour is still persisting. I believe that's much longer than the 600 (seconds?) set for the TTL of my domain.
What can I do to debug this issue further?