Several things come to my mind.
The forwarding in your screenshot looks OK. You could try to set it to TCP
instead of TCP/UDP
, because ssh is a TCP protocol.
dyndns
Are you sure that you use the correct dynamically updated hostname or your correct public IP address? To find your public IP address, open a console on the Raspberry or SSH (internally) into it and use curl icanhazip.com
.
sshd_config
Make sure, in /etc/ssh/sshd_config
, that sshd listens to the correct interface, in case you have multiple. Comment out the line ListenAddress a.b.c.d
with a #
and restart the service (/etc/init.d/sshd restart
or systemctl restart sshd
, depending on your distro).
Edit: sorry, you already said that.
Edit:
routing
If you cannot get an output from curl icanhazip.com
, chances are that your Raspberry does not know how to get to the internet. So it cannot reply to your connection attempt from the outside. Add a route, e. g. with ip route add default via <your modem's IP address>
and try again.
iptables
Make sure that your Raspberry-internal firewall allows SSH from external addresses. iptables -S
will give you a list of rules. Look for lines like
-A INPUT -s 192.168.0.0/24 -p tcp -m tcp --dport 22 -j ACCEPT
# SSH only allowed from the internal network, if iptables policy INPUT is DROP
In that case, allow all incoming traffic with either iptables -P INPUT ACCEPT
or iptables -I INPUT -p tcp --dport 22 -j ACCEPT
.
DS-Lite (Dual Stack Lite)
Internally, in your home network, you use IPv4 addresses. In your example 192.168.0.x. However, your ISP might use IPv6 in his network. The router translates your IPv4 addresses to IPv6. This usually results in the inability to connect to your home network from remote.
If curl icanhazip.com
gave you an IPv6 address, e. g. 2001:a61::35:2
, it might be an indicator. Also, maybe your C6300 will show information about that. (I use an AVM Fritz!Box 7360, and it explicitly outputs "Fritz!Box uses a DS-Lite tunnel").
To be 100% sure, call your ISP.
Edit:
In case you are behind a DS-Lite tunnel, the following options come to mind to nevertheless connect back home from remote:
- ask your provider/ISP to switch your line to a non-DS-Lite one
- use
autossh
to have your home computer connect to another host, e. g. at work (ask your employer before), your web server, your VPS. Configure autossh
in a way that it creates a reverse tunnel, e. g. ssh -R 10000:localhost:22 user@yourvps.com
. Then you can ssh to yourvps.com and ssh from there back home via ssh -p 10000 user@localhost
.
Edit:
Netgear C6300 specific
There seems to be a bug in firmwares until or up to Firmware Version 2.01.14 which will make opened ports visible only if the option "Respond to Ping on Internet WAN Port" in the "Advanced Configuration" > "WAN Setup" is activated.
![Netgear C6300 WAN Setup](../../I/static/images/b22a036b167502e53d97c4a6e5788eb05c2222a53f17ae40aa1c7ac654e2b745.jpg)
Note: this is absolutely a duplicate of http://superuser.com/questions/1019256/can-ssh-internally-but-cant-externally-port-22-connection-refused but that question is 5 months old with no answer, so I'm asking again.
– ocket8888 – 2016-06-13T05:39:38.537