Re: My home ISP blocking ssh protocol

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============6974326806366818627==
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="e6wXm6Qr8ggWY54rnir2Tl4xnfKFAwzEN"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--e6wXm6Qr8ggWY54rnir2Tl4xnfKFAwzEN
Content-Type: multipart/mixed; boundary="j4IKQz7MLLKltCmqgX1GN7gyfCAe8gnOL";
 protected-headers="v1"
From: Christopher Schultz <[email protected]>
To: [email protected]
Message-ID: <[email protected]>
Subject: Re: [stunnel-users] My home ISP blocking ssh protocol
References: <CADn9Oo2-CvAUAqojP2=nNsOQyZ85NhRpr52hPoKg42fSMF1wRA@mail.gmail.com>
 <[email protected]>
 <CADn9Oo2fwGdnQPyhG9VV-_M_4zAi1ifvdzszgBvuLKpyMKOxag@mail.gmail.com>
 <[email protected]>
 <CADn9Oo0ts8eAOTspicB-W3VtQiBgoUhU7ROxYqH1GgVZuM9o-A@mail.gmail.com>
In-Reply-To: <CADn9Oo0ts8eAOTspicB-W3VtQiBgoUhU7ROxYqH1GgVZuM9o-A@mail.gmail.com>

--j4IKQz7MLLKltCmqgX1GN7gyfCAe8gnOL
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable

Matt,

On 12/12/19 13:43, Matt Thomas wrote:
> Not sure if you have read the first post, or maybe i didnt add it, but =
i
> have tried port 22,5022,8022, 25565, 47506 and 443 haha.=20

It wasn't clear if you were changing the port number of the sshd service
(on your server) or the port you had open on your firewall/router. I
suspect that your ISP is blocking incoming connections to port 22. The
port number you use for sshd on the server is not relevant.

-chris

> On Thu, Dec 12, 2019, 9:44 AM Christopher Schultz
> <[email protected] <mailto:[email protected]>> wr=
ote:
>=20
>     Matt,
>=20
>     On 12/12/19 11:01, Matt Thomas wrote:
>     > Server is 192.168.0.10
>     > Router is 192.168.0.1
>     >
>     > It works fine internally:)
>     >
>     > I add a port forward in the router for port 22 pointed at .0.10.
>     Routers
>     > firewall all ready is configured to accept ssh on port 22 from an=
y
>     any.
>     >
>     > When ever anyone attempts to connect to the server, a pop up show=
s
>     on my
>     > screen. When i try to have my friends or co-workers try from ther=
e
>     house
>     > or i try from public place, no pop up or hits on the server log. =
Just
>     > times out.
>     >
>     > But if i put minecraft on port 22, it works. So certain traffic i=
s
>     > making it through. Even hamachi vpn works fine BUT i cant install=
 that
>     > on public PC's haha
>=20
>     I was about to say "this is clearly an issue with the port number, =
pick
>     something other than 22" but if you say you can run Minecraft over =
port
>     22, then that's ... strange.
>=20
>     I wasn't aware that Minecraft servers could have their ports change=
d
>     like that. You can really set up your Minecraft server to listen on=

>     localhost:22 and it doesn't use UPnP or anything like that to
>     reconfigure your firewall/router?
>=20
>     My advice is to try configuring things like this:
>=20
>     Router: 192.168.0.1
>     Forward WAN connections to port e.g. 1022 -> 192.168.0.10:1022
>     <http://192.168.0.10:1022>
>=20
>     Server: 192.68.0.1
>     Accept stunnel connections on port 1022
>     accept=3D:1022
>     connect=3Dlocalhost:22
>=20
>     If that works, I might even try just changing the port number of yo=
ur
>     ssh/sftp service from the "standard" port to something else and try=
ing
>     again without stunnel in the mix.
>=20
>     I've never encountered an ISP which does deep packet inspection to =
block
>     services. They usually just block ports.
>=20
>     -chris
>=20
>     > On Thu, Dec 12, 2019, 7:58 AM Christopher Schultz
>     > <[email protected]
>     <mailto:[email protected]>
>     <mailto:[email protected]
>     <mailto:[email protected]>>> wrote:
>     >
>     >     Matt,
>     >
>     >     On 12/11/19 17:53, Matt Thomas wrote:
>     >     > I need to know if Stunnel is going to accomplish what i nee=
d
>     to do. My
>     >     > home ISP blocks protocol HTTP and SSH from coming in so tha=
t
>     >     people cant
>     >     > run their own website from home without paying the ISP for =
a
>     >     "Business" line
>     >     >
>     >     > All i am trying to do is have a SFTP server that i can
>     access my dang
>     >     > files from while i am at school, work, friends house, libra=
ry or
>     >     > wherever. I have tried ssh on multiple random ports and mad=
e
>     sure all
>     >     > firewall rules and port forward rules were correct in my ho=
me
>     >     router. I
>     >     > know they work because i even went as far as setting up a
>     minecraft
>     >     > server to just test the port forward rules out and sure
>     enough, my
>     >     > friend 200 miles away can connect just fine to my home mine=
craft
>     >     > server.. But he can not connect to the ssh server. No logs
>     are ever
>     >     > created on the server either because something is stoping
>     the packet
>     >     > from even hitting my router, that something is my ISP
>     >     >
>     >     > Would stunnel allow me to make ssh traffic look like regula=
r
>     https
>     >     > traffic, thus allowing me to connect to my server at home s=
o
>     i can
>     >     do my
>     >     > homework??
>     >
>     >     Those other servers probably use TLS or plaintext connections=
=2E
>     stunnel
>     >     uses TLS, but ssh/sftp use a slightly different protocol that=
 may
>     >     possibly be distinguishable by a determined ISP.
>     >
>     >     I would think that using stunnel to tunnel SFTP/SSH would be
>     possible,
>     >     though not strictly necessary. I suspect some other problem i=
s
>     >     preventing you from succeeding.
>     >
>     >     Can you be more specific about exactly what you did for
>     configuration?
>     >     Port numbers, specific things you did, etc? You don't have to=

>     disclose
>     >     your public IP address, but perhaps give the local IPs of you=
r
>     router
>     >     and home server, etc?
>     >
>     >     -chris
>     >
>     >     _______________________________________________
>     >     stunnel-users mailing list
>     >     [email protected] <mailto:[email protected]>
>     <mailto:[email protected] <mailto:[email protected]=
>>
>     >     https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-user=
s
>     >
>=20
>     _______________________________________________
>     stunnel-users mailing list
>     [email protected] <mailto:[email protected]>
>     https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
>=20


--j4IKQz7MLLKltCmqgX1GN7gyfCAe8gnOL--

--e6wXm6Qr8ggWY54rnir2Tl4xnfKFAwzEN
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl3ymDoACgkQHPApP6U8
pFhJdBAAmXEMh3Oy78kBD6+EEY67L5JZ3d954N8//wLnUMMnDiYMfcVozsu/rKsK
giJmvcKgp3K8vkK6+WZN0oZvHx9XnVDurBfvpoVdDxZ3VsyFfxuIjFnFK+fvqb49
KMXBCFD3GOPnm720DcoW9c7FqiHiN+s+XdpjCYYS3FNVzgCdW3uR7phgARHj6nTh
4JNv9uOVhsBSaVmf4nvI7OIL9yL6gJAVc9D2n9rv4PzGHiI8VrvQ9kNvoLlWdb8p
ixuzReCoL9L1gYPQLlqPrSvJxelYNA/7xflEcb3nfHXOk6fh9BCct3LGXct4TeLE
lsXVND1nFdK6OTjvZ1EKZbN6PghFbsfGBZjq8VBVxoSvdheGgFGXubjDTYT6dykt
FV9467ZyhSZ8NDWHCaf2NLgwx5znZEpoZGRFBINTs80Ux5M82ahbPsLp8wIGTeuX
sRi1+nQugE+FVaYKLuObendOAMSyC+/8BYMSX3xOfraIuTC7vBdOzgfXvtdfE6vW
e+cc/j2Au7JVkjZAW58ORl1CVhqTWUDfcqS3ghr5Neexgj9tUrlCaurX0mId4+iZ
845blN75ijaCq1uyWm1To2nUWDBbvXmY2DZBMt++C966m/7eCz+LePM17riM8tv1
FZdbIgBAOR0w6i+0OcGH8SR4qcJePsIymTxm2qazmxmSsPiTuVI=
=lx5+
-----END PGP SIGNATURE-----

--e6wXm6Qr8ggWY54rnir2Tl4xnfKFAwzEN--

--===============6974326806366818627==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
stunnel-users mailing list
[email protected]
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

--===============6974326806366818627==--