At 08:11 AM 9/27/00 -0500, you wrote:
>Hello,
>
>My first post on the newbie list...
>
>I have been struggling for some time to get SSH to work on my Linux box
>(2.2.13-4mdk : Mandrake 6.1).
>I believe I finally have it up and running, because I am able to create a
>SSH connection from/to the machine itself.
>
>What I can't seem to manage is to make a SSH connection from an external
>machine (I work in DC, Linux box is at home in OH). I am trying using
>FiSSH and I repeatedly get "Failed to Connect to Host."
>
>Now, I do have a firewall up, and it is a pretty basic one in order to
>provide IP-Masquerading (which works!), so I thought
>maybe my problem was simply that the firewall wasn't letting the connection
>to port 22. So, after extensive research I felt
>that what I needed to add was a couple rules to allow the connection in,
>and I tried to add something like this (and other
>similar variations):
>
>ipchains -A input -p tcp -s xxx.xxx.com -d yyy.yyy.yyy.yyy 22 -j ACCEPT
>ipchains -A output -p tcp -d xxx.xxx.com -d yyy.yyy.yyy.yyy 22 -j ACCEPT
>
>But it isn't working - and I think my problem lies with xxx.xxx.com and
>yyy.yyy.yyy.yyy (the source and destination addresses).
>
>1. I don't exactly know the source IP address for where I'm at, so is it
>acceptable to use xxx.xxx.com instead?
>2. I have a variable IP - so how the heck do I populate yyy.yyy.yyy.yyy
>with my current IP address if I don't even know it?
>
>For #2 - I've seen some people use $IPADDR which is all well and good, but
>I don't know how to populate that variable without simply hardcoding and
>that just presents the same problem again.
>
>In addition, I typed in the ipchains commands (both above) at the command
>prompt and used what my IP address is currently and I still couldn't
>connect to it remotely via SSH. So now my entire solution has been
>undermined.
>
>Any suggestions?
>
>Thanks,
>George
I have the exact same setup as you do (almost) and ssh works from anywhere.
I just did this....
ipchains -A input -p tcp -d xxx.xxx.xxx.xxx 22 -j ACCEPT
If you are really concerned about the source address, try using the ip
address instead of the hostname/DNS name, because it may resolve to
something unexpected.
As you can see, in my example, I wasn't concerned with the source
address. Only the destination address and port number.
Dan
