I have just set up a new debian box and for the life of me I can not figure out what I did wrong. I can ssh and VNC into it from the local network but try as I might I can not connect from the internet. I always get connection refused.

I have checked IPTables and there are only the three base allow rules.

I did not install any firewall, and none of my other debian installs had this problem. I am at a loss, I have looked at everything I can think of.

Anyone have any ideas where to look?

-John

further information:

From outside network trying to ssh into new computer:

computer-name:~# ssh -vvv xxx.xxx.xxx.xxx
OpenSSH_4.3p2 Debian-9, OpenSSL 0.9.8c 05 Sep 2006
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to xxx.xxx.xxx.xxx [xxx.xxx.xxx.xxx] port 22.
debug1: connect to address xxx.xxx.xxx.xxx port 22: Connection refused
ssh: connect to host xxx.xxx.xxx.xxx port 22: Connection refused

On new computer:

new-computer:/etc# ps -ef|grep sshd
root 3174 1 0 Feb22 ? 00:00:00 /usr/sbin/sshd
root 4807 3174 0 Feb22 ? 00:00:01 sshd: root@pts/3
root 4556 4810 0 06:08 pts/3 00:00:00 grep sshd

new-computer:/etc# netstat -tanpl|grep sshd
tcp6 0 0 :::22 :::* LISTEN 3174/sshd

new-computer:/etc# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Also, it isnt the corportate firewall, as I put one of the other debian computers back into the ssh rule and I can connect to it from outside. It IS something in the config of the new computer.

-John

BAH! I figured it out.

The NAT address I was using in the firewall for the new computer was already in use and the connections were going to the other computer which WAS NOT a ssh capable computer.

the ol' KISS (Keep It Simple Stupid) principle at work. I am NOT happy with myself about missing that for so long.
On a related note the firewall complains when you assign a second name to a PORT number but NOT a duplicate NAT address. Where is the logic in that....


-John