Having issues in accessing Pfsense using SSH
-
@bhagya_jani2277 said in Having issues in accessing Pfsense using SSH:
So I think SSHGUARD is creating problem by blocking ports.
If it does so, it will leave a trace in de ... logs !!
SSHGUARD will block IP's that try but fail to login. You, as the admin, should not fail .....
It's set up with these :
What is your WAN IP ? is RFC1918 ?
If so, upstream NAT has been taken care of ?No "help me" PM's please. Use the forum, the community will thank you.
Edit : and where are the logs ?? -
@gertjan said in Having issues in accessing Pfsense using SSH:
What is your WAN IP ? is RFC1918 ?
Exactly... Show zero hits on either of those rules. And a any any rule on your wan.. Not something any sane person would ever do.
-
@gertjan I am getting internet through pppoe connection and i am really new to pfsense and my public ip starts like these : 103...** and i have found one thing by running this code pfctl -sr and came to know that SSHGUARD is by default blocking the ports
I have not configured any type of NAT rules coz I dont have any use case of NAT and to be frank I really dont know more about it !!
-
Those would both be logged.. Do you see a log saying its blocked?
I would suggest you validate traffic hits your IP.. Sniff.. Go to can you see me . org
Your rules show 0/0 - means nothing has even triggered them.. Do you have any rules in floating that would block? You say you can ping - then your IPv4 any any rule you have there should show some sort of hits some bytes - it wouldn't be 0/0
If sshguard was blocking - it would be in your logs.
See my wan rules - see how they show traffic hitting them, and some even have current states open.. Your are 0/0 - points to nothing even hitting your wan at all.
-
@johnpoz I tried in can you see me and it shows connection refused and port closed and I do not have any floating rules
-
Nothing is hitting here and port open which you can see is for ssh access
-
Where are you trying to connect from?
Are you trying to connect to the public IP address? And that's a PPPoE connection?
Why are you redacting your internal private 192.168 IP? Nobody can connect to that.
In ruleset you appear to be using 192.168.1.1 on re1 but what we can see in the screenshot shows 192.168.0.X. Are those both internal IPs?
Steve
-
@bhagya_jani2277 said in Having issues in accessing Pfsense using SSH:
t shows connection refused and port closed and I do not have any floating rules
Well yeah I can hit some random IP and get refused as well.. Or if port is not opened ssh client would say refused.. Even if you had no ssh running.. Your rule would still show a HIT.. even if pfsense didn't do anything with it.
So go to can you see me . org and put in whatever port you want to forward 2270.. And sniff on pfsense... Do you see that traffic get to pfsense? If no pfsense can not do anything, it can to forward it, it can not drop it, it can not reject it.. because its not SEEING IT!!
Here.. See I send traffic to 2270 and pfsense sees it!
For all we know were your tying to test from is blocking it, you have the wrong IP, etc. Until pfsense can see the traffic, there is nothing pfsense can do..
Maybe your ISP blocks inbound traffic, maybe where your testing from blocks that port.. You have to validate pfsense can actually see the traffic before you can forward it or hit some service running on pfsense.
-
@johnpoz I have talk to my isp about this and they replied me that they are not blocking any ports and I am also not using the random port but it is an ssh port which i have assigned to it.
I also tried to test this thing from different public ip but it also shows the same problem -
@stephenw10 Yeah they both are internal ip's
-
Dude sniff - it takes all of 10 seconds!!!
My point about random, was that refused on a ssh client means nothing.. That is what its going to tell you when the other end doesn't answer.. Normally something sent you a reject? So something actively rejected you.. Pfsense doesn't send rejects.. Unless you specifically set that up.
$ ssh 192.168.9.100 ssh: connect to host 192.168.9.100 port 22: Connection refusedSo something between your client and pfsense could of?
You have to validate your traffic is actually getting to pfsense.. This is done with a 10 second packet capture. And can you see me . org.. or your client trying to connect if can you see me . org you see, but when you try from your client you don't.. Then there is something wrong between your client and talking to pfsense IP on that port.
-
@johnpoz I tried a packet capture by specifying the 2270 port on pfsense and it is not getting any traffic to it !!
So, now i think i need to contact my isp once again and tell them to do something about it....
I today also tried to connect by ssh to my pfsense box from my macbook (different device than my everyday windows laptop) but it also shows the same error of connection refused. -
Is there some device in front of pfsense? Possible that is blocking?
Maybe your isp thought you meant outbound for ports, and not inbound.
But if pfsense doesn't see traffic, there is nothing it can do ;)
-
@johnpoz No i do not have any device in front of pfsense.
I am using it also as a router directly. I'll try to talk my isp about this inbound ports. -
I found the solution !!! Finally
People whose ISP uses pppoe method have two different types of IP’s , One is Static and another is Dynamic.
It doesn’t matter that your public ip doesn’t change anytime but if it is in the series of Dynamic ip’s by default it will block all the incoming ports at isp’s router/firewall.Solution is simple: Just pickup the phone ,call your isp and ask them; Is my ip dynamic or static?? If replies dynamic so just ask them to allot you an static ip and boom!! problem will be solved…
Thank you so much everyone for replying to my answers
-
Glad you found the problem.
That is not normally the case. Most PPPoE ISPs will pass all traffic to any IP type. I have dynamic IPs delivered over PPPoE from two ISPs here in the UK and both are completely open.
Steve
-
@bhagya_jani2277 said in Having issues in accessing Pfsense using SSH:
is in the series of Dynamic ip’s by default it will block all the incoming ports at isp’s router/firewall.
So like I said - something upstream blocking ;)
