Can't establish outbound ssh connection on an OpenBSD system

UNIX BSD
1

I am getting the below error when I try to make outbound ssh from an OpenBSD system. I can't ssh to any host except the localhost. I can ping the hosts which I can't ssh, though.

~ uname -rs
OpenBSD 6.1
~ ssh -V       
OpenSSH_7.5, LibreSSL 2.5.2
~ ssh hostname
ssh: connect to host hostname port 22: No route to host

I can ssh to hostname from other Linux or BSD machines without any problem.

2

(local?) firewall?

3

I was told by the sysadmin it is not the firewall.

4

If you can ping them there is a route.. nothing funny in the hosts firewall? Can you post the output of pfctl -sr

5

I can't ssh to any hosts from this OpenBSD server at all. But I can ssh to all these other hosts from my Linux machine or other BSD or windows machines.

~ pfctl -sr
pfctl: /dev/pf: Permission denied
6

Output of ssh -vvv hostname ?

7 
~ ssh -vvv sdf.org                                                                                       
OpenSSH_7.5, LibreSSL 2.5.2
debug1: Reading configuration data /etc/ssh/ssh_config
debug2: resolving "sdf.org" port 22
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to sdf.org [205.166.94.15] port 22.
debug1: connect to address 205.166.94.15 port 22: No route to host
ssh: connect to host sdf.org port 22: No route to host
8

Is that a new problem? New system installation? Recent ssh update? Any recent changes?
Is port 22 open and sshd listening on the remote node?

9

So, this is a connection to a public IP address. It could well be one or more of:-

  • There is a firewall at the server side
  • There are PAM rules on the server side to authenticate your client (or proxy) source address. Check https://www.unix.com/what-is-my-ip.php to see what you need to have allowed.
  • There is a NAT or IP tables diverting you elsewhere
  • There is a proxy server either denying access or diverting you somewhere else.

The above list is not exhaustive, but they might give you a start.

A few questions to explore with:-

  • Has this worked from before?
  • Can you test trying to get to it from home?

Robin

1 Like
10

This has never worked. I was thinking I wasn't allowed to use outbound ssh, but looks like that wasn't the case.

As I tried to explain it before, I can not ssh out from the server which runs OpenBSD to any other server. Yes, I can ssh from home, or from any other server. I can't make outbound ssh connections from the server which runs OpenBSD.

11

Hi,

There are quite a number of possibilities here, but lets start with the simple things first.

  • Can you ping the OpenBSD system from another system.
  • What result do you get if you run the ssh commands as the root user.
  • From one of your Linux system try telnet host_ip port# so something like telnet 123.123.123.123 22 and post the output.

It is also worth running a traceroute from your Linux system and post the output. For reference you can also run a traceroute to googles servers with traceroute 8.8.8.8 - a comparison of the results may give you a hint.

You could also compare the /etc/networks file with a working system, in case there are any routes defined.

You could also post the output of ifconfig -a check that there is a gateway address assigned.

Regards

Gull04

12

it looks like I can't ping to that OpenBSD system from some other systems. Here is the output from my linux fedora:

~ ping -c 4 grex.org
PING grex.org (75.61.90.157) 56(84) bytes of data.

--- grex.org ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3105ms

I do not have root privileges on that system.

~ telnet 75.61.90.157 22
Trying 75.61.90.157...
Connected to 75.61.90.157.
Escape character is '^]'.
SSH-2.0-OpenSSH_7.5
Connection closed by foreign host.

~ ifconfig -a
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 32768
        index 3 priority 0 llprio 3
        groups: lo
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3
        inet 127.0.0.1 netmask 0xff000000
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        lladdr 2a:69:d3:eb:66:a0
        index 1 priority 0 llprio 3
        groups: egress
        media: Ethernet autoselect (1000baseT full-duplex)
        status: active
        inet 75.61.90.157 netmask 0xffffffc0 broadcast 75.61.90.191
enc0: flags=0<>
        index 2 priority 0 llprio 3
        groups: enc
        status: active
pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33188
        index 4 priority 0 llprio 3
        groups: pflog