unable to SSH to machine over LAN

Question

Level 2

204 points

unable to SSH to machine over LAN

Hi,
Sorry if this has been asked before, i searched extesively and couldn't find an answer.

I have a pretty standart netowrk at home: a Macbbok, a Mac Mini, one PC (work), all wired with ethernet cables. Ocasionally i connect my iPod Touch.

I bought an iPod app (Briefcase) which once worked, but now it doesn't. With a lot of help from the dev i was able to determine that *i can't ssh between any two machines in my LAN*. I can ssh to remote servers.

I checked all the basic settings (remote login is enabled, it shows as allowed in the firewall settings). I can ssh to the same machine (ssh me@localhost). The sharing pref pannel says "type this and that to connect to this machine", but looks like it is a lie 🙂

I can see that my Time Capsule has a setting saying "subnet mask 255.255.255.255" (there seems to be no way to change this), and my macs say "subnet mask 255.255.255.0". My DSL modem is in bridge mode, the TC is connected to it. The modem says in its LAN settings "subnet mask 255.0.0.0", i tried changing that then i lost connection to it and had to reset it to factory settings (pushing a recessed button with a pen); it is an old DLink. The macs have addresses like 10.0.1.7 and 10.0.1.199.

(also, my wife is having problems using her PC's VPN, which connects but doesn't work right - i suspect when i get my LAN right she will have her VPN working).

I will be gratefull for any help!

Macbook 2.2Ghz Intel, Mac OS X (10.5.6)

Posted on May 6, 2009 6:06 AM

Reply

Answer 1

santanu

Level 1

25 points

May 6, 2009 1:53 PM in response to Eduardo

hi Eduardo,

I'm pretty confused by your description. Couple of questions:

1. How you trying the ssh - using the IP-adress or host name?
2. The D-Link one just a modem or a modem-router?
3. What type of IP configuration you have - static or DHCP?
4. If DHCP, the which device providing the service - D-Link or TC?
5. What's the IP address of your D-Link and TC?
6. What's Gateway IP address?

BTW, you certainly can change the subnet mask on the TC. open the AirPort Utility and then *Manual Setup > Internet > Internet Connection*. Change the Configure IPv4 to "Manually in there and then you get the option to enter the value[s] manually. What "Connection Sharing" did you specify in that very same screen? Cheers!!!

Reply

Answer 2

Eduardo Author

Level 2

204 points

May 6, 2009 5:01 PM in response to santanu

Hi santanu,
Thank you for your reply. I am confused really, that's why my description was confusing!

So:
1. I am testing ssh from one computer to itself typing "ssh me@localhost" (hostname, in this case), and when i try to ssh to the other mac in the LAN i type "ssh username@10.0.1.7" (IP in this case) because that is what it told me to do in the Sharing prefs pane;
2. The D-Link is a cable modem and router, but it is configured as a bridge, so i think it only plays the modem role, right?
3. I am using DHCP everywhere;
4. The TC is providing the DHCP service in the LAN;
5. Well, i don't know how to discover the D-Link LAN IP address without connecting it directly by a cable to my Macbook (thus removing the TC completely from the LAN). When i do this, i am able to access the D-Link web configuration interface at 10.1.1.1. Looking at the Sharing pref pane with the LAN set up as described in 2, 3 and 4, it says the router address is 10.0.1.1, i supose this is the TC's IP in the LAN. In the Airport Utility it says "my" IP is 201.29.131.242, i guess that is the IP address the ISP assigned to my router (the TC).
6. That would be 201.29.131.242, right? It changes from time to time, the TC drops the connection sometimes. Not a TC problem, the ISP is not that good here.

I understood the directions on how to change the subnet mask in the TC, but to do that i have to select "connect using ethernet" first, otherwise it will not show the "configure IPv4" option. I am using "connect using PPPoE", and i type in my username and password (required by the ISP). Is there a different way to set this up if i need to provide a username and password?
Connection sharing is greyed out (using PPPoE), but it reads "share a public IP address".

If you need me to do any troubleshooting, please just tell me. Thank you for your help.

Reply

Answer 3

santanu

Level 1

25 points

May 7, 2009 1:04 AM in response to Eduardo

Well, I'm not a long time TC user but in my experience, the best way of using it in a multi-router environment (like yous - D-Link and the TC) is to put TC itself in "Bridge mode" ( not the modem/router). Let your D-Link to do all the monkey business like NAT, DHCP etc. and use TC as WiFi base station. You can still enjoy the Gigabit connectivity, when connected via LAN, offered by the TC. So give it another go like this:

1. Disable the WiFi stuff on the D-Link (if you have)
2. Switch back to your normal D-Link setup as you have before started using TC (i.e. as router)
3. Connect TC from one of the D-Link LAN ports to the WAN port of the TC
4. Open AirPort utility and enter the "Manual Setup"
5. Open Internet pane and change the Connection Sharing to "Off (Bridge Mode)
6. Change "Connect Using" to "Ethernet"
7. Manually configure the IP Address/subnet mask in accordance with D-Link
8. Use an IP address for the TC outside of your DHCP range
9. Put the D-Link's address (I think that's 10.1.1.1 in your case) as "Router Address" and "DNS Server"
10. Click "Update" and wait for TC to come back

After that, it should be alright. This is the way I've get it configured. I have a some what complicated multi-OS environment (4 Macs, 1 Windows, 2 Linux, 1 Alpha) at home and it works just fine for me.

When you get it done, fire up the Terminal and issue the command: +*ifconfig en1 | grep "inet " | cut '-d ' -f1,2*+ (assuming you connected via wire, if WiFi use en1 in stead) and try ssh using the IP address from another computer putting -v flag like this: +*ssh -v username@10.1.1.xx*+ (replace xx with the actual number). -v option will print some debug message. If you see you can connect then you don't need to use -v all the time. Otherwise print those messages here.

Hope this helps and fixes your problem. Let us know how it goes. Cheers!!!

Reply

Answer 4

santanu

Level 1

25 points

May 7, 2009 2:29 AM in response to santanu

santanu wrote:
When you get it done, fire up the Terminal and issue the command: +*ifconfig en1 | grep "inet " | cut '-d ' -f1,2*+ (assuming you connected via wire, if WiFi use en1 in stead)

Oops!!! Just noticed a typo here; it should be: +*ifconfig en0 | grep "inet " | cut '-d ' -f1,2*+ for wired connection and en1 for WiFi computers. Cheers!!!

Reply

Answer 5

Eduardo Author

Level 2

204 points

May 7, 2009 5:53 AM in response to santanu

Hey santanu,
I will try that and post the results in a couple of hours (i must keep the internet working right now).
Thanks again!

Reply

Answer 6

Eduardo Author

Level 2

204 points

May 7, 2009 6:32 PM in response to santanu

Hey Santanu,
Back from work, kid asleep, then i changed the configuration as you instructed.

I see the D-Link is now the router, and the TC is acting only as a switch (both wired and wireless), right? What i have now is:
- The D-Link has my username and password, and i can access its web interface. All seems right.
- The TC shows its green light. I has an IP of 10.1.1.35 (which i gave it since the D-Link web interface says "end IP address 10.1.1.34" in its DHCP config page).
- I set the TC's subnet mask to match the D-Link's, both show 255.0.0.0. Router and DNS addresses in the TC are set to 10.1.1.1 (the D-Links IP address).

After this i pasted the ifconfig comand (with the typo corrected). The result, as far as i can tell, was that a inet 10.1.1.x comand was issued at each machine, were x is the machine end IP number as assigned by the router.

Unfortunately, i still can't connect with ssh. The verbose result is (from machine 10.1.1.3 to 10.1.1.8):

macbook-eduardo:~ eduardo$ ssh -v eduardo@10.1.1.8
OpenSSH_5.1p1, OpenSSL 0.9.7l 28 Sep 2006
debug1: Reading configuration data /etc/ssh_config
debug1: Connecting to 10.1.1.8 [10.1.1.8] port 22.
debug1: connect to address 10.1.1.8 port 22: Operation timed out
ssh: connect to host 10.1.1.8 port 22: Operation timed out

Now i would have to ask three questions:
1. Did i follow your instructions correctly?
2. I would have to change the subnet mask to 255.255.0.0 so my wife's VPN works right (some time ago, it wouldn't connect with 255.0.0.0, and changing it to 255.255.0.0 made the trick). I tried this, changing the value in the D-Link, the TC, and renewing the Mac's DHCP concession, and even the internet would be inaccessible. Can i use a different subnet mask?
3. Even if your configuration works, which will be a great improvement, there would be one small thing: my D-Link is like 10 years old, and it isn't UPnP. I bought the TC mainly because it has NAT/PMP and i can use Lighthouse to forward ports efforlessly. Using the D-Link as the router defeats the purpose of having bought the TC!

Thanks again for your time and patience.

Reply

Answer 7

Eduardo Author

Level 2

204 points

May 7, 2009 7:24 PM in response to Eduardo

- disregard this one please -

Reply

Answer 8

Eduardo Author

Level 2

204 points

May 7, 2009 7:25 PM in response to Eduardo

Ok, i decided to reboot the Macs - it looked like that ifconfig command was an elegant way to do the same as rebooting. Rebooting solved the problem: i can now ssh in the LAN (and outwards too).

Now only two questions remain: 2 and 3 above. Can i have a more restrictive subnet mask (255.255.0.0 for example)? Is there a way to make it all work, and keep the NAT-PMP capabilities as when i have the TC working as a router?

Reply

Answer 9

santanu

Level 1

25 points

May 8, 2009 12:50 PM in response to Eduardo

Eduardo wrote:
2. I would have to change the subnet mask to 255.255.0.0 so my wife's VPN works right (some time ago, it wouldn't connect with 255.0.0.0, and changing it to 255.255.0.0 made the trick). I tried this, changing the value in the D-Link, the TC, and renewing the Mac's DHCP concession, and even the internet would be inaccessible. Can i use a different subnet mask?

Glad to see it worked. Yes, you can use different Subnet mask; I actually have 255.255.255.128 for my network. In the IPv4 world, Subnetting an IP network allows a single large network to be broken down into several smaller logical ones and it works in very special way. The network bits are represented by all 1s in the mask, followed by the 0s for the node bit. Hence only those numbers representing such sequences i.e. 0, 128, 192, 224, 240, 248, 252, 254, and 255 are allowed for the netmask. For example,an IP address 192.168.1.254, with a subnet mask of 255.255.255.0, would become this in binary form:

*+IP address: 11000000.10101000.00000001.11111110 (i.e. 192.168.11.254)+*
*+Netmask: 11111111.11111111.11111111.00000000 (i.e. 255.255.255.0)+*

which simply means we want 256 nodes/hosts per network. The formula to figure out the number of 'host' bits in a subnet mask is: *+2^n={number of nodes} (2^n means '2' to the power of 'n')+*

As 256 = 2^8, hence n=8, which simply means we want to leave 8 zero(0) bits in the subnet mask. Thus, the netmask is: 11111111.11111111.11111111.00000000 i.e. 255.255.255.0

If you want, say 64 nodes per network, you get “n = 6”, since 64 = 2^6. So, the netmask would be:
11111111.11111111.11111111.11000000 i.e. 255.255.255.192

So, it's totally up to you how many hosts you want per subnet. For a home netwprk, 255.255.255.224 (14 hosts per subnet) should be absolutely fine.

3. Even if your configuration works, which will be a great improvement, there would be one small thing: my D-Link is like 10 years old, and it isn't UPnP. I bought the TC mainly because it has NAT/PMP and i can use Lighthouse to forward ports efforlessly. Using the D-Link as the router defeats the purpose of having bought the TC!

So, does it simply mean your D-Link router can't do NAT thing? What thing you think missing not having UPnP? I think I never enabled that. I don't know about Lighthouse to be honest and I think it's better if you let your hardware router to do that job. If you an ADSL user, then I really recommend you to upgrade your modem/router to ADSL+ one. You can just have a modem this time ( not the modem/router that you presently have) and then let TC to do the NAT, DHCP etc. Does it make any sense to you? cheers!!!

Reply

Answer 10

Eduardo Author

Level 2

204 points

May 9, 2009 9:29 AM in response to santanu

Hi Santanu,

Thank you for your explanation on the subnet mask, that was enlightening. And of course thank you for helping me sort the problem out. Now even my wife's VPN is working fine.

santanu wrote:
So, does it simply mean your D-Link router can't do NAT thing? What thing you think missing not having UPnP?

This Light house program (please see here: http://www.codelaide.com/blog/products/lighthouse ) is a dynamic port forwarding utility: if the router in UPnP or NAT-PMP the program controls it, and you can turn port forwarding on and off with a single click. No need to go into the router's configuration interface or reboot it.
Now i can do the port forwarding by typing 10.1.1.1 in the browser and setting port forwarding, and i also have to set some static IP addresses in the LAN. But with UPnP all i have to do is click on my menubar!

santanu wrote:
You can just have a modem this time ( not the modem/router that you presently have) and then let TC to do the NAT, DHCP etc. Does it make any sense to you?

Oh, i didn't understand thi one. When i had my old configuration, before you helped me, my D-Link which is a modem/router was in bridge mode - doesn't that mean it is acting as a modem only? And i did have my TC configured to do the NAT and DHCP! That setup was causing the problems, right?
Now , after you helped me out, i have the D-Link configured to act as the modem and do the NAT & DHCP thing, and the TC is just a switch. If i buy a new modem which is a modem only (not a router too), i will go back to my old setup, won't i?

Thank you again for your time and patience in walking me through all this.

Reply

Answer 11

santanu

Level 1

25 points

May 9, 2009 7:33 PM in response to Eduardo

Eduardo wrote:
Thank you for your explanation on the subnet mask, that was enlightening. And of course thank you for helping me sort the problem out. Now even my wife's VPN is working fine.

Does she find it useful? My wife always complains that Linux guys always make things complected and I'm the worst one. lol!!!

Eduardo wrote:
Oh, i didn't understand thi one. When i had my old configuration, before you helped me, my D-Link which is a modem/router was in bridge mode - doesn't that mean it is acting as a modem only? And i did have my TC configured to do the NAT and DHCP! That setup was causing the problems, right?

I'm not sure why it was causing problem; it should have worked. The "Bridge" mode operates at the Data Link Layer (i.e. OSI layer 2) and do not understand any thing other than the pure physical medium (MAC) i.e. an Ethernet. On the other hand, Router runs at the Network Layer (i.e. OSI layer 3) and handles the typical routed protocols, such as IP. A router passes traffic between two logically separated networks whereas a bridge only passes traffic between two networks which are logically the same. I think, it didn't work as you were probably running two different network, one from D-Link and another from TC. Anothre thing was confusing - the modem should have your ISP's login info but you said that info on the TC that time. A modem/router is basically a combination of modem/router/PPPoE client/NAT in a single box. I think, a stand alone router is much more easier to put in bridge mode than a modem/router.

Eduardo wrote:
Now , after you helped me out, i have the D-Link configured to act as the modem and do the NAT & DHCP thing, and the TC is just a switch. If i buy a new modem which is a modem only (not a router too), i will go back to my old setup, won't i?

Yes I suppose and if you want your TC to be the router for your network, your best bet is to use a true modem like D-Link DSL-320B in my opinion.

Cheers!!!

Reply

Answer 12

Eduardo Author

Level 2

204 points

May 12, 2009 4:03 PM in response to santanu

Hey santanu,

All of your help was very useful, thank you. I got my network working! I will try to set it up with the D-Link as a bridged modem and the TC as the router again, to see what happens, but if it doesn't work i know how to go back.

Thanks a lot!

Reply

Answer 13

May 12, 2009 4:13 PM in response to Eduardo

Hi Eduardo,
Unfortunately, due to bugs in Apple's code, if your firewall is on, neither SSH nor AFP are usable. I discovered this myself last summer using trial and error.
Thus if you want to be able to remotely log into your machines, you must turn off the firewall.
Cheers,
Paul

Reply

Answer 14

santanu

Level 1

25 points

May 13, 2009 12:36 PM in response to Paul Borokhov

Paul Borokhov wrote:
Thus if you want to be able to remotely log into your machines, you must turn off the firewall.

I don't think that's really true - I'm mainly a Linux user; most of the time I use terminal on my Macs and my firewall is always on. I have no problem doing ssh to my Macs from any of the machines. Enabling "Remote Login" from the Sharing pane just do the job.

I also use AFP to mount the drive from my Linux desktops and it works flawlessly as well. I'm running 10.5.6

Cheers!!!

Cheers,
Paul

Reply

Answer 15

Eduardo Author

Level 2

204 points

May 14, 2009 3:45 PM in response to santanu

I have the firewall on on both my Mini and my Macbook (with remote login enabled in the Sharig pane). Both work after following santanu's instructions.

However, i have one more piece of info to share: i took my Macbook on the road and connected in a hotel room. Back home, i plugged into my network: i could ssh from my Macbook to my Mini, but not from my Mini to my Macbook.
I closed my session in the Macbook and started again, but nothing changed. Then i rebooted my Macbook, and all came back to normal.

So it looks like it's not the setup at home, or at least it is not only the setup at home. I hope there is a gracefull method of getting things back to normal after a trip - a command line script or something like the command santanu directed me to issue before, so i don't have to reboot every time i come back home.

I still have to test the network again in my original configuration (TC as router, bridged modem) and reboot all machines to see if i can get ssh working in that setup too. Please standby for the results...

Reply