Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Having issues in accessing Pfsense using SSH

    Scheduled Pinned Locked Moved Firewalling
    18 Posts 4 Posters 3.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      bhagya_jani2277 @Gertjan
      last edited by bhagya_jani2277

      @gertjan I am getting internet through pppoe connection and i am really new to pfsense and my public ip starts like these : 103...** and i have found one thing by running this code pfctl -sr and came to know that SSHGUARD is by default blocking the ports

      Sshguard.PNG

      I have not configured any type of NAT rules coz I dont have any use case of NAT and to be frank I really dont know more about it !!

      johnpozJ 1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @bhagya_jani2277
        last edited by johnpoz

        Those would both be logged.. Do you see a log saying its blocked?

        I would suggest you validate traffic hits your IP.. Sniff.. Go to can you see me . org

        Your rules show 0/0 - means nothing has even triggered them.. Do you have any rules in floating that would block? You say you can ping - then your IPv4 any any rule you have there should show some sort of hits some bytes - it wouldn't be 0/0

        If sshguard was blocking - it would be in your logs.

        See my wan rules - see how they show traffic hitting them, and some even have current states open.. Your are 0/0 - points to nothing even hitting your wan at all.

        wanrules.png

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        B 2 Replies Last reply Reply Quote 1
        • B
          bhagya_jani2277 @johnpoz
          last edited by

          @johnpoz I tried in can you see me and it shows connection refused and port closed and I do not have any floating rules

          johnpozJ 1 Reply Last reply Reply Quote 0
          • B
            bhagya_jani2277 @johnpoz
            last edited by

            @johnpoz rulewan.png

            Nothing is hitting here and port open which you can see is for ssh access

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by stephenw10

              Where are you trying to connect from?

              Are you trying to connect to the public IP address? And that's a PPPoE connection?

              Why are you redacting your internal private 192.168 IP? Nobody can connect to that.

              In ruleset you appear to be using 192.168.1.1 on re1 but what we can see in the screenshot shows 192.168.0.X. Are those both internal IPs?

              Steve

              B 1 Reply Last reply Reply Quote 1
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @bhagya_jani2277
                last edited by johnpoz

                @bhagya_jani2277 said in Having issues in accessing Pfsense using SSH:

                t shows connection refused and port closed and I do not have any floating rules

                Well yeah I can hit some random IP and get refused as well.. Or if port is not opened ssh client would say refused.. Even if you had no ssh running.. Your rule would still show a HIT.. even if pfsense didn't do anything with it.

                So go to can you see me . org and put in whatever port you want to forward 2270.. And sniff on pfsense... Do you see that traffic get to pfsense? If no pfsense can not do anything, it can to forward it, it can not drop it, it can not reject it.. because its not SEEING IT!!

                Here.. See I send traffic to 2270 and pfsense sees it!

                sniff.png

                For all we know were your tying to test from is blocking it, you have the wrong IP, etc. Until pfsense can see the traffic, there is nothing pfsense can do..

                Maybe your ISP blocks inbound traffic, maybe where your testing from blocks that port.. You have to validate pfsense can actually see the traffic before you can forward it or hit some service running on pfsense.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                B 1 Reply Last reply Reply Quote 1
                • B
                  bhagya_jani2277 @johnpoz
                  last edited by

                  @johnpoz I have talk to my isp about this and they replied me that they are not blocking any ports and I am also not using the random port but it is an ssh port which i have assigned to it.
                  I also tried to test this thing from different public ip but it also shows the same problem

                  1 Reply Last reply Reply Quote 0
                  • B
                    bhagya_jani2277 @stephenw10
                    last edited by

                    @stephenw10 Yeah they both are internal ip's

                    johnpozJ 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @bhagya_jani2277
                      last edited by johnpoz

                      Dude sniff - it takes all of 10 seconds!!!

                      My point about random, was that refused on a ssh client means nothing.. That is what its going to tell you when the other end doesn't answer.. Normally something sent you a reject? So something actively rejected you.. Pfsense doesn't send rejects.. Unless you specifically set that up.

                      $ ssh 192.168.9.100
                      ssh: connect to host 192.168.9.100 port 22: Connection refused
                      

                      So something between your client and pfsense could of?

                      You have to validate your traffic is actually getting to pfsense.. This is done with a 10 second packet capture. And can you see me . org.. or your client trying to connect if can you see me . org you see, but when you try from your client you don't.. Then there is something wrong between your client and talking to pfsense IP on that port.

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      B 1 Reply Last reply Reply Quote 1
                      • B
                        bhagya_jani2277 @johnpoz
                        last edited by

                        @johnpoz I tried a packet capture by specifying the 2270 port on pfsense and it is not getting any traffic to it !!
                        So, now i think i need to contact my isp once again and tell them to do something about it....
                        I today also tried to connect by ssh to my pfsense box from my macbook (different device than my everyday windows laptop) but it also shows the same error of connection refused.

                        johnpozJ 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @bhagya_jani2277
                          last edited by

                          Is there some device in front of pfsense? Possible that is blocking?

                          Maybe your isp thought you meant outbound for ports, and not inbound.

                          But if pfsense doesn't see traffic, there is nothing it can do ;)

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          B 1 Reply Last reply Reply Quote 1
                          • B
                            bhagya_jani2277 @johnpoz
                            last edited by

                            @johnpoz No i do not have any device in front of pfsense.
                            I am using it also as a router directly. I'll try to talk my isp about this inbound ports.

                            1 Reply Last reply Reply Quote 0
                            • B
                              bhagya_jani2277
                              last edited by

                              I found the solution !!! Finally
                              People whose ISP uses pppoe method have two different types of IP’s , One is Static and another is Dynamic.
                              It doesn’t matter that your public ip doesn’t change anytime but if it is in the series of Dynamic ip’s by default it will block all the incoming ports at isp’s router/firewall.

                              Solution is simple: Just pickup the phone ,call your isp and ask them; Is my ip dynamic or static?? If replies dynamic so just ask them to allot you an static ip and boom!! problem will be solved…

                              Thank you so much everyone for replying to my answers 🙏

                              johnpozJ 1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                Glad you found the problem.

                                That is not normally the case. Most PPPoE ISPs will pass all traffic to any IP type. I have dynamic IPs delivered over PPPoE from two ISPs here in the UK and both are completely open.

                                Steve

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @bhagya_jani2277
                                  last edited by

                                  @bhagya_jani2277 said in Having issues in accessing Pfsense using SSH:

                                  is in the series of Dynamic ip’s by default it will block all the incoming ports at isp’s router/firewall.

                                  So like I said - something upstream blocking ;)

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  1 Reply Last reply Reply Quote 1
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.