Having issues in accessing Pfsense using SSH

bhagya_jani2277

Nothing is hitting here and port open which you can see is for ssh access

stephenw10

Where are you trying to connect from?

Are you trying to connect to the public IP address? And that's a PPPoE connection?

Why are you redacting your internal private 192.168 IP? Nobody can connect to that.

In ruleset you appear to be using 192.168.1.1 on re1 but what we can see in the screenshot shows 192.168.0.X. Are those both internal IPs?

Steve

johnpoz

@bhagya_jani2277 said in Having issues in accessing Pfsense using SSH:

t shows connection refused and port closed and I do not have any floating rules

Well yeah I can hit some random IP and get refused as well.. Or if port is not opened ssh client would say refused.. Even if you had no ssh running.. Your rule would still show a HIT.. even if pfsense didn't do anything with it.

So go to can you see me . org and put in whatever port you want to forward 2270.. And sniff on pfsense... Do you see that traffic get to pfsense? If no pfsense can not do anything, it can to forward it, it can not drop it, it can not reject it.. because its not SEEING IT!!

Here.. See I send traffic to 2270 and pfsense sees it!

For all we know were your tying to test from is blocking it, you have the wrong IP, etc. Until pfsense can see the traffic, there is nothing pfsense can do..

Maybe your ISP blocks inbound traffic, maybe where your testing from blocks that port.. You have to validate pfsense can actually see the traffic before you can forward it or hit some service running on pfsense.

bhagya_jani2277

@johnpoz I have talk to my isp about this and they replied me that they are not blocking any ports and I am also not using the random port but it is an ssh port which i have assigned to it.
I also tried to test this thing from different public ip but it also shows the same problem

bhagya_jani2277

@stephenw10 Yeah they both are internal ip's

johnpoz

Dude sniff - it takes all of 10 seconds!!!

My point about random, was that refused on a ssh client means nothing.. That is what its going to tell you when the other end doesn't answer.. Normally something sent you a reject? So something actively rejected you.. Pfsense doesn't send rejects.. Unless you specifically set that up.

$ ssh 192.168.9.100
ssh: connect to host 192.168.9.100 port 22: Connection refused

So something between your client and pfsense could of?

You have to validate your traffic is actually getting to pfsense.. This is done with a 10 second packet capture. And can you see me . org.. or your client trying to connect if can you see me . org you see, but when you try from your client you don't.. Then there is something wrong between your client and talking to pfsense IP on that port.

bhagya_jani2277

@johnpoz I tried a packet capture by specifying the 2270 port on pfsense and it is not getting any traffic to it !!
So, now i think i need to contact my isp once again and tell them to do something about it....
I today also tried to connect by ssh to my pfsense box from my macbook (different device than my everyday windows laptop) but it also shows the same error of connection refused.

johnpoz

Is there some device in front of pfsense? Possible that is blocking?

Maybe your isp thought you meant outbound for ports, and not inbound.

But if pfsense doesn't see traffic, there is nothing it can do ;)

bhagya_jani2277

@johnpoz No i do not have any device in front of pfsense.
I am using it also as a router directly. I'll try to talk my isp about this inbound ports.

bhagya_jani2277

I found the solution !!! Finally
People whose ISP uses pppoe method have two different types of IP’s , One is Static and another is Dynamic.
It doesn’t matter that your public ip doesn’t change anytime but if it is in the series of Dynamic ip’s by default it will block all the incoming ports at isp’s router/firewall.

Solution is simple: Just pickup the phone ,call your isp and ask them; Is my ip dynamic or static?? If replies dynamic so just ask them to allot you an static ip and boom!! problem will be solved…

Thank you so much everyone for replying to my answers

stephenw10

Glad you found the problem.

That is not normally the case. Most PPPoE ISPs will pass all traffic to any IP type. I have dynamic IPs delivered over PPPoE from two ISPs here in the UK and both are completely open.

Steve

johnpoz

@bhagya_jani2277 said in Having issues in accessing Pfsense using SSH:

is in the series of Dynamic ip’s by default it will block all the incoming ports at isp’s router/firewall.

So like I said - something upstream blocking ;)