Re: [tlug] SSH Vs. Linksys BEFW11S4

[Thomas Savarimuthu <viswas_thomas@example.com>]

Can put some flow diagram the IP/MASK of each black box? Looks like there is 
many NAT or routing problem. 

-Thomas

On Wednesday February 18 2004 17:26, Jonathan Byrne wrote:
> I'm fairly certain this isn't a Linux question per so, but a Linksys
> question, but here goes.
>
> I have a Linksys BEFW11S4 with a couple of boxen dangling from it.
> The Linksys has a global static IP address on the external interface.
> It NATs my inside network.
>
> Upstream from it is a Xyxel Prestige cable router, also with a global
> static IP.  The Xyxel has a NATted network and DHCP server which I
> am not using (except for testing, as outlined below).
>
> The Linksys is configured to forward port 22 to a Linux box on the inside.
>
> If I ssh from the inside to the external address of the Linksys, this
> works without issue.  I get an ssh connection to the inside machine.
>
> If I ssh from the outside, no joy.  It times out.  It is confirmed to not
> be a firewalling issue on the ssh box; shutting off the firewall and
> leaving it totally open does not change the situation.
>
> "Outside" can be defined as loosely as plugging my Thinkpad into a port
> on the Zyxel and grabbing a NATted IP address there via DHCP.  From there
> I can ping the Linksys but get an ssh timeout.  Needless to say, it doesn't
> work from "really outside" (such as from my office), either.
>
> Googling has not so far yielded an answer to why it doesn't work, but
> has shown that people use port forward of ssh on this model of Linksys
> with success.  The only difference is they don't (AFAIK) have another
> router standing in front of the Linksys.  That theoretically shouldn't
> matter, of course.
>
> If the Linksys were a Cisco, this would all be much easier.  Curse you,
> web interface! :-p  I may change over to one of the newer Linksys wireless
> G routers, since the third-party images for those do some slick things,
> including OSPF and IPTables.  Not that I need OSPF on a /30 stub network,
> but it's cool to have the ability :-)
>
> In the meantime, I'll google onward, unless anyone else out there has
> already slain this dragon and would care to lend me his sword :-)
>
> TIA,
>
> Jonathan