[Solved] Change SSH port: no route to host (Oracle Cloud)

Hello all. I’m trying to change the SSH port on an Oracle VM, but I’m getting nowhere and I don’t know where to solve the issue.

I have changed the SSH port:


<span style="color:#323232;">edit /etc/ssh/sshd_config
</span>

Entered the port info:


<span style="color:#323232;">Port 5522
</span>

I restarted the service:


<span style="color:#323232;">sudo systemctl restart ssh
</span>

And made sure that the port is open:


<span style="color:#323232;">ss -an | grep 5522
</span><span style="color:#323232;">tcp   LISTEN 0      128                                                                               0.0.0.0:5522                0.0.0.0:*            
</span><span style="color:#323232;">tcp   LISTEN 0      128                                                                                  [::]:5522                   [::]:*    
</span>

I also allow incoming traffic to 5522:


<span style="color:#323232;">sudo ufw allow 5522/tcp comment 'Open port ssh tcp port 5522'
</span>

AND just to make sure, I allow ‘routed’:


<span style="color:#323232;">sudo ufw default allow FORWARD
</span>

And make sure the FW config is valid:


<span style="color:#323232;">sudo ufw status verbose
</span><span style="color:#323232;">Status: active
</span><span style="color:#323232;">Logging: on (medium)
</span><span style="color:#323232;">Default: deny (incoming), allow (outgoing), allow (routed)
</span><span style="color:#323232;">New profiles: skip
</span><span style="color:#323232;">
</span><span style="color:#323232;">To                         Action      From
</span><span style="color:#323232;">--                         ------      ----
</span><span style="color:#323232;">22/tcp                     ALLOW IN    Anywhere                   # Open port ssh tcp port 22
</span><span style="color:#323232;">5522/tcp                   ALLOW IN    Anywhere                  
</span><span style="color:#323232;">22/tcp (v6)                ALLOW IN    Anywhere (v6)              # Open port ssh tcp port 22
</span><span style="color:#323232;">5522/tcp (v6)              ALLOW IN    Anywhere (v6)              # Open real ssh tcp port 22
</span>

Yet, I cannot connect to this server. Trying to ssh -vvvv -p 5522 [ip-adress] yields this:


<span style="color:#323232;">OpenSSH_9.0p1 Ubuntu-1ubuntu8.4, OpenSSL 3.0.8 7 Feb 2023
</span><span style="color:#323232;">debug1: Reading configuration data /etc/ssh/ssh_config
</span><span style="color:#323232;">debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
</span><span style="color:#323232;">debug1: /etc/ssh/ssh_config line 21: Applying options for *
</span><span style="color:#323232;">debug2: resolve_canonicalize: hostname 129.x.x.5 is address
</span><span style="color:#323232;">debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> '/home/x/.ssh/known_hosts'
</span><span style="color:#323232;">debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> '/home/x/.ssh/known_hosts2'
</span><span style="color:#323232;">debug3: ssh_connect_direct: entering
</span><span style="color:#323232;">debug1: Connecting to 129.x.x.5 [129.x.x.5] port 5522.
</span><span style="color:#323232;">debug3: set_sock_tos: set socket 3 IP_TOS 0x10
</span><span style="color:#323232;">debug1: connect to address 129.x.x.5 port 5522: No route to host
</span><span style="color:#323232;">ssh: connect to host 129.x.x.5 port 5522: No route to host
</span>

I can connect just fine when the port is at 22, but as soon as I change it to 5522, i get the ‘no route to host’ error.

I’ve made sure I have rules on Oracle cloud that allows ingress and egress traffic to 0.0.0.0/0 on all protocols, no matter the destination / source.

What am I doing wrong? It feels that this problem is host (server) based rather client based, since I’m getting a routing error. Do I need to configure the routing for that port specifically, and if so how?

PS: Also, connecting to localhost:5522 from the server itself works fine. So the problem is not in the configuration, but likely network related.


EDIT: This issue is solved, solution written on this post: lemmy.ml/comment/2787074

krash,

So I managed to smash a few buttons randomly again, and get this solved.

There are a few things to be aware of:

  • Oracle doesn’t like ufw. So I disabled it and uninstalled it. Having ufw installed may result in bad stuff. Link
  • I decided to flush all rules in ip-tables to start on a clean slate: sudo iptables -F
  • While I’m at it, I’ve changed ip-tables to allow ALL. THE. INBOUND. TRAFFIC: sudo iptables -I INPUT -j ACCEPT
  • One last thing, I’ve changed the state of the firewall to go from stateful to stateless, still with no restrictions on the ingress / egress traffic.

This is, of course, not a recommended setup for a host to be used in production or to have critical data, but it gave me a host in a working state that I can work with.

Some posts that helped me in this:

tetra,
@tetra@feddit.de avatar

Ist that 0.0.0.0/24 CIDR a typo? That suffix should probably be /0.

Also make sure to actually assign the firewall to your instance’s subnet in the Oracle cloud Interface.

krash,

Correct - that was a typo, I’ve corrected the original post. Not a good idea to write a report when you’re angry and tired… 🤣

The firewall (Network Security Group in Oracle lingo) is indeed attached to the subnet. I think I’ve solved the issue, will write it in a seperate post and link it to the original post.

silent_water,
@silent_water@hexbear.net avatar

ufw allow 22/tcp comment ‘Open port ssh tcp port 22’

is this a typo or is port 5522 actually not open on your firewall?

krash,

Correct - that was a typo in this post. The output from sudo ufw status verbose is however correct.

I think I’ve solved the issue, will write it in a seperate post and link it to the original post.

randombullet,

Do you have a firewall between the two devices?

Can you do a packet capture to make sure that both ends are behaving as expected?

Can you double check your IPs. I’ve had this issue before by fat fingering

  • All
  • Subscribed
  • Moderated
  • Favorites
  • random
  • uselessserver093
  • Food
  • aaaaaaacccccccce
  • [email protected]
  • test
  • CafeMeta
  • testmag
  • MUD
  • RhythmGameZone
  • RSS
  • dabs
  • Socialism
  • KbinCafe
  • TheResearchGuardian
  • Ask_kbincafe
  • oklahoma
  • feritale
  • SuperSentai
  • KamenRider
  • All magazines