Re: gaining access to webconf from the net does not work (for me !)

Hello Erich, and List...

> On Jul 4, 2022, at 04:23, Erich Titl <[email protected] <mailto:[email protected]>> wrote:
> 
> Hi
> 
> Am 04.07.2022 um 05:21 schrieb jeanrocco jr:
>> Hello List,
>> I might be asking a newbie question here, so be gentle !
>> I used to be able to access the webconf webpage of my firewall from the net
>> using " ssh -L8080:192.168.1.254:80 [email protected] <mailto:[email protected]> " and then
>> enter the url: localhost:8080 in the outside computer browser... as you all
>> well know how to. But this is not working anymore, I always get a "channel
>> 3 fail to connect".
> 
> So you are building a ssh tunnel to your external address then probably avoiding shorewall (as the tunneled traffic probably takes the lo interface) to access the inner interface with on port 80.

Right, this is the answer I get from : 

ssh -L8080:192.168.1.254:80 [email protected] <mailto:[email protected]> -vvv

debug1: Connection to port 8080 forwarding to 192.168.1.254 port 80 requested.
debug2: fd 10 setting TCP_NODELAY
debug3: fd 10 is O_NONBLOCK
debug3: fd 10 is O_NONBLOCK
debug1: channel 3: new [direct-tcpip]
channel 3: open failed: connect failed:
debug2: channel 3: zombie
debug2: channel 3: garbage collecting
debug1: channel 3: free: direct-tcpip: listening port 8080 for 192.168.1.254 port 80, connect from 127.0.0.1 port 58796, nchannels 4
debug3: channel 3: status: The following connections are open:
  #2 client-session (t4 r0 i0/0 o0/0 fd 7/8 cc -1)

and on the browser:

The connection was reset

The connection to the server was reset while the page was loading.

    The site could be temporarily unavailable or too busy. Try again in a few moments.
    If you are unable to load any pages, check your computer’s network connection.
    If your computer or network is protected by a firewall or proxy, make sure that Firefox is permitted to access the Web.
> 
>> Is anybody aware of any changes in shorewall, or any other settings that
>> could cause this. My logs are not showing anything strange.
> 
> - Have you tried to connect directly to box without the ssh tunnel?

Not yet, from the outside, this would imply opening port 80 to the web. My firewall currently presents no open ports to the net, I use some form of port knocking to open the ssh port and then ssh to it (in the LEAF documentation: Passwordless logins and port knocking chapters). Of course I use rsa keys, no password.

> - Is port forwarding enabled on sshd.conf?

I’m using Dropbear, the forwardings are enabled by default, and I tried the -a options (Allow connections to forwarded ports from any host) without success… 

Accessing the web page on the internal net (192.168.1.254:80) works fine of course, what is surprising is that it used to work before from the net. I tried old Browsers… same result. For now I can always access my firewall web page by first connecting to one of my internal VNC running machine: ssh -L5901:192.168.1.35:5901 [email protected] <mailto:[email protected]> and from it’s browser access http://192.168.1.254 <http://192.168.1.254/> … but this is a tad bulky !!!

SO just curious about this apparent behaviour changing !

thank’s
jrb


> 
> cheers
> 
> ET
> ------------------------------------------------------------------------
> leaf-user mailing list: [email protected] <mailto:[email protected]>
> https://lists.sourceforge.net/lists/listinfo/leaf-user <https://lists.sourceforge.net/lists/listinfo/leaf-user>
> Support Request -- http://leaf-project.org/ <http://leaf-project.org/>
------------------------------------------------------------------------
leaf-user mailing list: [email protected]
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/