I'm not using Port 22 for my SSH but something above 47000
I have ufw (uncomplicated firewall) installed and have unblocked "ssh" and "http"
When I look into the current ufw status he says that Port 22 and Port 80 are allowed from everywhere. I configures this thing via SSH
My SSH connection wasn't interrupted by it. Even tho I'm not using Port 22 for my SSH. Not I've unlocked that special port for 47000+ too. Now I have both ports open on as well IPv4 and IPv6
Do I need to have both unlocked? Can I delete the Port 22? I wouldn't ask this question if my SSH connection would have collapsed but now I'm confused what Port SSH really uses
Is the 47000+ Port only used for the handshake?
I'm sorry for this (near-to-irrelevant) question but I fear that I might never be able to SSH to my server again when I have a wrong Firewall config
2 Answers
Do I need to have both unlocked?
No.
Can I delete the Port 22?
Yes.
I wouldn't ask this question if my SSH connection would have collapsed but now I'm confused what Port SSH really uses
Typically, your existing connection will not be effected. We would have to see your resulting iptables rule set to know for certain, but your existing/related tcp connection should bypass the closed port check. You can verify by trying to make a new ssh session (as mentioned by the comment from @Joes).
Is the 47000+ Port only used for the handshake?
No. That port will be used for all the SSH traffic.
There are a few things you need to setup at minimum to have SSH working, and this configuration then changes down the line depending on what you wanna do.
Lets assume for everything right now, that you are on your own internal network and are keeping all the values default, for now until we know this works. then we will continue with an advanced config.
For now, no port forwarding is needed, that is the final step. For now we only need to know the service is enabled, what IP the remote machine has, and on what port the ssh-server daemon listening, and if the remote firewall is blocking incoming requests for SSH.
step 1 -install and enable the openSSH-server service (on the remote machine)
step 2-Disable firewall (on the remote machine)
If you're not 100% sure if you disabled the remote firewall or not, do:
sudo service ufw status
there you will see its status, when active, let's disable it for now.
sudo service ufw disable
If you have just installed openssh-server and you didn't change the config, the default port is set to 22. If you have changed the SSH config to listen on another port, restarting ssh-server service is required. The spawned SSH process is still cached in memory and will only start serving on a different port the moment a new SSH-server daemon process is spawned.
As such, do:
sudo service ssh restart
now move over to the client PC. Ping the remote machine. That is step one for basic connectivity, but ping is a bad tool for testing protocol or service issues. They exist on different OSI layers. now open your ssh client, this can be putty or something else, or just a terminal window in linux works fine too.
After doing above steps, this should really work to connect, if not, repeat previous steps or ask more questions.
If you kept things default, and its working, now would be the time to switch over the ssh port if desired. so for example let's say you changed the port from 22, to 2200 in the ssh-server config on remote machine, the next step would be to enable the firewall on remote machine, but this time add some rules after. As soon as the rules are loaded-in and the firewall is enabled, for good measure restart ufw service and ssh service once more, then try to connect.
If you changed the SSH port from 22 to 2200, you would have to
ALLOW a rule for TCP rule for PORT 2200 from ANY adress
it will add the same rule for ipv6 automatically.
if you are comfortable turning off UFW on remote machine for now that is fine too.
Now that SSH is working on your local network, you can start configuring remote access. This is different for each router but about the same process.
Find in the menu of your modem/router a category for port forwarding, usually under firewall/internet or IP configuration. when you found port forwarding, what you wanna do is forward an external port (this can be any port, comes down to personal preference and security) for example a random port, 8422. This would be the remote port that we connect to whenever we are outside. We forward this port, to the internal port 2200 that we have set on the machine.
so instead of internal IP and port, now we use the external IP adress, and the external port. this is now configured to tunnel directly to the 2200 port on internal network, and should be reachable. if this last step gives you issues, restart modem/router and remote server completely. if that still doens't work, but the internal ssh does, you can be sure the configuration is not yet correct. Permission denied error sounds like you're trying to access SSH on the wrong port. so you can reach the machine, but the port that is requested for SSH is not serving that, so the permission is denied.
Hope this helped.
