0

I often have to use my company's VPN to access corporate sites - but I'd like to be able to access my machines on my LAN without having to disconnect from VPN.

Previously, my approach has been:

  • Configure my LAN router to forward an external port to the ssh port on a local machine
  • Configure a domain name to always point at my LAN's public IP
  • Use ssh -p <external_port> <domain>

and that's worked fine. Recently, however (in the last ~2 days), this approach has failed - ssh -vvv ... hangs at debug1: Connecting to <domain> port <external_port> for about 30 seconds, and then prints ssh: connect to host <domain> port <external_port>: Operation timed out. Trying to ssh to the IP directly gives a similar result. If I'm not connected to the VPN, however, I can still ssh to that domain as expected.

Here's what I've tried:

  • I've confirmed that <domain> points at the correct IP:
$ curl http://ifconfig.co/json | grep '"ip"' # From a machine on my local network
  "ip": "<ip>"
$ dig <domain> | grep -A 1 'ANSWER SECTION'
;; ANSWER SECTION:
<domain>.   600 IN  A   <ip>
  • I've confirmed (visually, from my router's UI) that <external_port> is correctly forwarded to the appropriate internal IP and port (is there a way to confirm that programmatically?). I've restarted the router in case there was some latent issue. The router is a Google Wifi router.
  • While on VPN, I've tried Tracing a Route to the domain. Here's the output (from Mac OS' Network Utility:)
Traceroute has started…

traceroute to <domain> (<ip>), 128 hops max, 72 byte packets
 1  freeip.amazon.com (10.85.80.141)  9.752 ms  13.708 ms  13.822 ms
 2  freeip.amazon.com (10.40.1.108)  22.153 ms  14.089 ms  22.384 ms
 3  freeip.amazon.com (10.40.1.40)  17.305 ms  36.349 ms  34.767 ms
 4  10.40.1.25 (10.40.1.25)  12.462 ms  23.093 ms  11.888 ms
 5  sfo8-8-np-edg-fw1.amazon.com (10.40.1.30)  12.816 ms  14.120 ms  11.842 ms
 6  10.40.1.34 (10.40.1.34)  23.566 ms  9.135 ms  28.704 ms
 7  * * *
 8  * * *
 9  * * *
10  * * *
11  * * *
12  * * *
13  * * *
14  * * *
15  * * *
16  * * *
17  * * *
18  * * *
19  * * *
20  * * *
21  * * *
22  * * *
...

A friend's Linux box (from outside my LAN, but not on my work's VPN) gets a similar "infinite hang" when trying to trace a route to my IP, so I know it's not specific to the VPN.

  • I also tried pinging the domain, and consistently got timeouts:
$ ping <domain>
PING <domain> (<ip>): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
Request timeout for icmp_seq 4
Request timeout for icmp_seq 5
  • The day that I noticed that I was no longer able to connect was the same day that I installed a pi-hole on my home LAN. I don't think this is the cause (and another, more network-knowledgable friend agrees) - but, just in case, I disabled the pi-hole 2 days ago, and this behaviour is still persisting. I believe that's much longer than the 600 (seconds?) set for the TTL of my domain.

What can I do to debug this issue further?

1
  • 1
    I'm pretty new to this particular site (though a lot more experience on StackOverflow), so, if you'd be willing to give it, I'd appreciate some guidance on why this was downvoted to 0 and how I could have asked this question better.
    – scubbo
    Mar 3 at 23:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.