ssh tunnel with diffferent gateway fails to work

Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking
Author Message
Gcom
DD-WRT Novice


Joined: 14 Aug 2010
Posts: 8

PostPosted: Mon Nov 01, 2010 12:45    Post subject: ssh tunnel with diffferent gateway fails to work Reply with quote
What I want to do:

Code:
Remote location -- ssh tunnel -- wrt54gl with dd-wrt at home -- wan http sites


I tried to accomplish this with the aid of several tutorials, e.g.
http://hetos.de/sshtut.html
http://www.dd-wrt.com/wiki/index.php/Easy_SSH_tunnels

This is however not working; when I try to access sites they timeout.

I assume this has to do with the fact that the wrt54gl is not hosting the connection to the internet itself. This is the topology:

Code:
wrt54gl @ 192.168.0.123 -- cable modem with 4 port switch @ 192.168.0.1 [default gateway]


The wrt54gl is configured in 'routing mode' as operating mode.
Subnet mask 255.255.255.0 and default gateway 192.168.0.1
I am able to ping wan domain names from a ssh session and also lan ip addresses work properly.

Putty is being used from a windows host to tunnel at the client side.

This should cover most of the configuration information. I'd be happy to provide more if needed.

Any tips would be deeply appreciated

TIA
Sponsor
phuzi0n
DD-WRT Guru


Joined: 10 Oct 2006
Posts: 10141

PostPosted: Mon Nov 01, 2010 22:29    Post subject: Reply with quote
Set the routing mode back to gateway mode and it should work.
_________________
Read the forum announcements thoroughly! Be cautious if you're inexperienced.
Available for paid consulting. (Don't PM about complicated setups otherwise)
Looking for bricks and spare routers to expand my collection. (not interested in G spec models)
Gcom
DD-WRT Novice


Joined: 14 Aug 2010
Posts: 8

PostPosted: Tue Nov 02, 2010 0:05    Post subject: Reply with quote
Thanks for your answer.

I tried setting it back to gateway and it still doesn't work.

When looking in my putty event log the following error keeps showing up:

Code:
2010-11-02 00:55:51   Opening forwarded connection to www.74.125.79.104:80
2010-11-02 00:55:51   Forwarded connection refused by server: Connect failed []


When I come to think about it, when the http request for google.com goes trough the local proxy, to the ssh tunnel to my wrt54gl, does it know that 74.125.79.104 is outside of its network and that it should handle it to the default gateway?

Or should there be separate iptables written in order to tell it to forward *:80 request to my default gateway and also for the response of the server back to the browser?
phuzi0n
DD-WRT Guru


Joined: 10 Oct 2006
Posts: 10141

PostPosted: Tue Nov 02, 2010 0:12    Post subject: Reply with quote
You do have the default gateway set on the wrt54gl don't you? The OP suggested so but your last post suggested not. If you look at the routing table of the wrt54gl then it should have a default route to your gateway. You should also be able to ssh to it and then ping websites from it if you configured it correctly.

route -n

_________________
Read the forum announcements thoroughly! Be cautious if you're inexperienced.
Available for paid consulting. (Don't PM about complicated setups otherwise)
Looking for bricks and spare routers to expand my collection. (not interested in G spec models)
Gcom
DD-WRT Novice


Joined: 14 Aug 2010
Posts: 8

PostPosted: Tue Nov 02, 2010 11:22    Post subject: Reply with quote
phuzi0n wrote:
You do have the default gateway set on the wrt54gl don't you? The OP suggested so but your last post suggested not.


I have. It is set to 192.168.0.1 (Network Setup -> Router IP)

phuzi0n wrote:
If you look at the routing table of the wrt54gl then it should have a default route to your gateway.


Code:

root@DD-WRT:~# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 br0
169.254.0.0     0.0.0.0         255.255.0.0     U     0      0        0 br0
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
0.0.0.0         192.168.0.1     0.0.0.0         UG    0      0        0 br0


phuzi0n wrote:

You should also be able to ssh to it and then ping websites from it if you configured it correctly.
route -n


Code:

root@DD-WRT:~# ping google.com
PING google.com (74.125.79.104): 56 data bytes
64 bytes from 74.125.79.104: seq=0 ttl=52 time=17.635 ms
64 bytes from 74.125.79.104: seq=1 ttl=52 time=17.467 ms
64 bytes from 74.125.79.104: seq=2 ttl=52 time=19.384 ms


I also forgot to mention in my previous posts that the wrt54gl is connected to my default gateway on lan port 1.
Gcom
DD-WRT Novice


Joined: 14 Aug 2010
Posts: 8

PostPosted: Tue Nov 02, 2010 22:35    Post subject: Reply with quote
Ok this is odd...

While I was trying to install an ipk package with ipkg it won't download the package.

Code:
ipkg_download: ERROR: Failed to retrieve http://downloads.openwrt.org/backports/rc6/oidentd_2.0.8-1_mipsel.ipk, returning


SPI Firewall has been turned of and I am able to both ping and nslookup downloads.openwrt.org.

Anyone that can explain what's going on? Confused
phuzi0n
DD-WRT Guru


Joined: 10 Oct 2006
Posts: 10141

PostPosted: Wed Nov 03, 2010 3:22    Post subject: Reply with quote
*shrug*

My only guesses are either a MTU size problem or the main router blocking port 80 for some reason. You can try ssh'ing to the router and then from the router telnet to port 80, 443, and any other ports on sites that you know will have them open. Just check if you get a connection at all, it's fine if it closes.

telnet google.com:80
telnet google.com:443

_________________
Read the forum announcements thoroughly! Be cautious if you're inexperienced.
Available for paid consulting. (Don't PM about complicated setups otherwise)
Looking for bricks and spare routers to expand my collection. (not interested in G spec models)
Gcom
DD-WRT Novice


Joined: 14 Aug 2010
Posts: 8

PostPosted: Wed Nov 03, 2010 10:56    Post subject: Reply with quote
I noticed that I couldn't telnet into an external site.
This, together with the ipkg_download: ERROR got me looking for solutions on the ipkg error.

Eventually I found the solution in this post:

http://secure.dd-wrt.com/phpBB2/viewtopic.php?p=163181#163181

Quote:
After doing "echo 0 >/proc/sys/net/ipv4/tcp_ecn" in an SSH shell, the /bin/ipkg worked fine for me.


While looking up what this command does I found this information regarding ecn:

http://en.wikipedia.org/wiki/Explicit_Congestion_Notification

I am no expert but shouldn't this be disabled in dd-wrt by default? I've sent an email to the developers to get more information about this issue.
phuzi0n
DD-WRT Guru


Joined: 10 Oct 2006
Posts: 10141

PostPosted: Wed Nov 03, 2010 12:54    Post subject: Reply with quote
Gcom wrote:
I am no expert but shouldn't this be disabled in dd-wrt by default? I've sent an email to the developers to get more information about this issue.

Your gateway router should know how to handle it correctly (support it or ignore it). ECN is a good thing and helps prevent packet loss by warning that the network is getting congested.

_________________
Read the forum announcements thoroughly! Be cautious if you're inexperienced.
Available for paid consulting. (Don't PM about complicated setups otherwise)
Looking for bricks and spare routers to expand my collection. (not interested in G spec models)
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum