Port is open, yet cannot connect from outside.

I am able to connect remotely if I use a normal internet connection such as a USB dongle. All uptill now I've been trying to connect using my office PC which sits behind a proxy. So I guess the proxy creates some issues.

Anyways this proves that my home setup is working ok. Thanx for all the trouble u took.

What is the firewall configuration (iptables -L -v) on the nettop? Does it allow SSH from outside the LAN? Do you have TCPWrappers (/etc/hosts.allow and /etc/hosts.deny) configured to limit access to only the LAN? Does anything appear in your SSH logs?

Finally, have you checked that the firewall at your office allows you to SSH home? Try from a friend or colleagues home connection if you don't want to ask the IT staff at work.

Edit: So, did you restart SSH? What does netstat -pant|egrep 22 show?

Sorry, due to issues with the forum software I'm currently unable to post multiple answers

Based on your latest answer I'd say you've got a problem with your SSH server's configuration. If packets are reaching it then that's the only explanation.

Does the nettop have Internet access? Is the default gateway set?

To check the default gateway is set you would enter netstat -rn or route print and look for a line like

          0.0.0.0          0.0.0.0     192.168.1.1   192.168.1.32      25

If you see a line like that the default gateway is set. The default gateway is how the computer knows ot reach the Internet, which it sounds like it can.

At this point the possibilities I can see are:

1. Your WAN IP is not a public IP address (that is it starts 10., 192.168. or 172.16. to 172.32.)
2. Your ISP filters inbound traffic
3. You have more than one routing device (ie a modem and a router)
4. Your router doesn't do port forwarding correctly

thanx for offering to help. I too think this is a problem with the nettop rather than the router not forwarding ports. Here are the details.

iptables -L -v returns

Chain INPUT (policy ACCEPT 476K packets, 325M bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 434K packets, 487M bytes)
pkts bytes target prot opt in out source destination

so I'm sure the firewall's clean.

My hosts deny and allow files contain no entries (only the default comment at the top of the file preceded with the # sign).

In addition I ran nmap with the following results. Note 10.0.0.8 is the nettops IP address on the LAN.

nmap 10.0.0.8

Starting Nmap 5.00 at 2010-02-02 21:38 IST
Interesting ports on 10.0.0.8:
Not shown: 999 closed ports
PORT STATE SERVICE
5900/tcp open vnc

Nmap done: 1 IP address (1 host up) scanned in 1.36 seconds

nmap localhost

Starting Nmap 5.00 at 2010-02-02 21:39 IST
Warning: Hostname localhost resolves to 2 IPs. Using 127.0.0.1.
Interesting ports on localhost (127.0.0.1):
Not shown: 997 closed ports
PORT STATE SERVICE
631/tcp open ipp
5900/tcp open vnc
45100/tcp open unknown

Nmap done: 1 IP address (1 host up) scanned in 0.95 seconds

What i noticed is that 22222 which is the port I have configured for SSH does not come up as open in the nmap port scan. I have the sshd_config file as follows :

# What ports, IPs and protocols we listen for
Port 22222
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 10.0.0.8

So Im guessing that the SSH daemon would have bound to 10.0.0.8 on port 22222.

NMap should have shown that port 22222 was open. A point of interest is where are you trying the public IP from? It will always fail from behind the router. It should succeed from outside the router.

Also, port 22222 is a vector port for several known virus and trojans https://www.incidents.org/port.html?port=22222

As such, it may be filtered on the Internet by ISPs and other routers. You might want to try a different port....

I tried accessing the router page from my office by typing the dyndns host name (at home I jus type the internal IP that is reserved to it and it loads). The usernmame / password entry box appeared and when I entered them, the browser changed its address from the dyndns host name to 10.0.0.2 and tried to load the page and eventually failed.

Why does my router have to resolve the dyndns hostname to its local IP address ? any ideas ? I think this is the same happening with regards to opening an SSH connection.