Hello everyone. Probably a simple answer but not sure where to look. I've got a pi for pihole and a laptop as a server for foundry and some game servers. I've assigned them static IPs in Luci, but I can't seem to be able to ssh into them. Is this an ssh configuration problem on the router? Do I need to allow port forwarding somewhere? Or is the issue elsehwere? Thanks for your help.
From where ?
Everything that happens on the LAN side, between different stations on your LAN is outside of the control of the router. Ethernet is a primarily a peer-to-peer network, each of your peer can (and does) talk to the others without the router being in the loop (and all LAN ports are bridged, so transparent to the network).
If you cross firewall zones, the situation obviously changes and depends on your configuration.
From LAN or WLAN to be precise.
So this is potentially a device configuration issue? For reference the device I was testing my SSHing from was connected to Wifi instead of ethernet. That hasn't made a difference in the past but I suppose it's worth mentioning.
unless you have a wifi network that is distinctly different than your wired lan, the issue is local to your hosts, not related to OpenWrt. The default configuration of OpenWrt is to have a single network that spans both ethernet and wifi.
We can review your config and that will tell us with near certainty if OpenWrt is involved or not.
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall
Board Info
{
"kernel": "6.6.67",
"hostname": "OpenWrt",
"system": "ARMv8 Processor rev 0",
"model": "Bananapi BPI-R4",
"board_name": "bananapi,bpi-r4",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "SNAPSHOT",
"revision": "r28406-d1e9c50d06",
"target": "mediatek/filogic",
"description": "OpenWrt SNAPSHOT r28406-d1e9c50d06",
"builddate": "1735035828"
}
}
Network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fdf0:661c:48f5::/48'
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'sfp-lan'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
config device
option name 'br-wan'
option type 'bridge'
list ports 'wan'
list ports 'sfp-wan'
config device
option name 'wan'
config device
option name 'sfp-wan'
config interface 'wan'
option device 'br-wan'
option proto 'dhcp'
config interface 'wan6'
option device 'br-wan'
option proto 'dhcpv6'
Wireless
config wifi-device 'radio0'
option type 'mac80211'
option path 'soc/11300000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
option radio '0'
option band '2g'
option channel '1'
option htmode 'EHT20'
option cell_density '0'
option country 'US'
config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'Superfastnetwork'
option encryption 'sae-mixed'
option ocv '0'
option ieee80211r '1'
option ft_over_ds '0'
config wifi-device 'radio1'
option type 'mac80211'
option path 'soc/11300000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
option radio '1'
option band '5g'
option channel 'auto'
option htmode 'EHT40'
option cell_density '0'
option country 'US'
config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option ssid 'Superfastnetwork'
option encryption 'sae-mixed'
option ocv '0'
option ieee80211r '1'
option ft_over_ds '0'
config wifi-device 'radio2'
option type 'mac80211'
option path 'soc/11300000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
option radio '2'
option htmode 'EHT160'
option cell_density '0'
option country 'US'
option band '6g'
option channel 'auto'
config wifi-iface 'default_radio2'
option device 'radio2'
option network 'lan'
option mode 'ap'
option ssid 'Superfastnetwork_6G'
option encryption 'sae'
option ocv '0'
DHCP
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option localservice '1'
option ednspacket_max '1232'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
option ra_slaac '1'
list ra_flags 'managed-config'
list ra_flags 'other-config'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
config host
option ip '192.168.1.89'
option leasetime 'infinite'
option name 'pihole'
config host
option name 'foundryserver'
option ip '192.168.1.8'
option leasetime 'infinite'
Firewall
config defaults
option syn_flood '1'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
There is nothing in your configuration that would interfere with any two devices on your network from connecting to each other. Therefore, the problem is with the client devices themselves. Check their local firewalls and make sure that their ssh servers are up and running, listening for inbound connections.
I'll spend some time with them. There shouldn't be anything wrong with the devices since I was able to SSH into them previously with my previous router. The only thing that is different is that they had different static IPs since the router address was 192.168.0.1 instead of .1.1. I did already try rebooting both devices as well.
Update: Using hostnam works, but using IP does not. This must be something to do with how I've set up DHCP?
Please provide examples of your connection attempts and any errors you see.
Have you verified that you are using the correct address to connect??
I actually managed to solve it, I can now ssh over IP. I had to check the "Forward/reverse DNS" setting in the static lease settings and that seems to have fixed the issue. For some reason it seems like by default it only resolves hostnames? I'm not sure how that could possibly work
This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.