topic Re: Remote Access - SSH to Gateway in Firewall and Security Management

Remote Access - SSH to Gateway

Christopher_To — Thu, 30 Sep 2021 19:03:55 GMT

Hi,

I can't SSH to the firewall the I connect to via remote access VPN. Firewall rules are in place for SSH and webUI access to the firewall. I know in other VPN communities there is a tab for "excluded services". Is there a similar option for remote access VPN community?

I can get to the webUI but I can't SSH. Logs show traffic being decrypted.

I am running R81.10 mgmt and R80.40 firewall.

Thank you.

Re: Remote Access - SSH to Gateway

the_rock — Thu, 30 Sep 2021 19:32:49 GMT

Do you see any logs for port 22 when trying?

Re: Remote Access - SSH to Gateway

Christopher_To — Thu, 30 Sep 2021 19:33:27 GMT

Yup

Re: Remote Access - SSH to Gateway

the_rock — Thu, 30 Sep 2021 19:34:52 GMT

What do they show? Did you try zdebug on command line?

Re: Remote Access - SSH to Gateway

Christopher_To — Fri, 01 Oct 2021 16:44:36 GMT

Hmm I don't see logs anymore but I did enable split tunneling and manually specified the encryption domain.

I do have a firewall rule that should allow this traffic...

Src: office mode network

Dst: FW

Services: SSH and webUI port

I am able to access the webUI and I see accept and decrypt logs for this traffic from my office mode IP to the internal IP of the firewall.

When I try to SSH I don't see logs. I do see drops in the zdebug. It shows this connection being dropped but the weird thing is the source is my external IP trying to hit destination of the external IP of the firewall.

Shouldn't this traffic be hitting the same rule that allows webUI access?

Re: Remote Access - SSH to Gateway

the_rock — Fri, 01 Oct 2021 17:00:31 GMT

Message me directly, I have time to do remote, I have a feeling its something simple you might be missing.

Cheers!

Re: Remote Access - SSH to Gateway

genisis__ — Sat, 02 Oct 2021 14:08:16 GMT

Silly question have you updated the allowed list in GAIA?

Re: Remote Access - SSH to Gateway

Christopher_To — Mon, 04 Oct 2021 15:40:48 GMT

Thank you Rock and Genesis for your help. I found the issue. My SSH session was saved with the external IP, and I did not realize until now. 😅

Re: Remote Access - SSH to Gateway

the_rock — Mon, 04 Oct 2021 18:49:49 GMT

Well, sometimes smallest things pose a problem. Glad it works now : - )

Re: Remote Access - SSH to Gateway

genisis__ — Tue, 05 Oct 2021 08:13:20 GMT

Its a good reminder to us all, check the basics first!

Re: Remote Access - SSH to Gateway

the_rock — Tue, 05 Oct 2021 13:19:40 GMT

I agree with you wholeheartedly!