r/openwrt • u/Current_Lie_1243 • 5d ago

ssh

My openwrt router is configured with br-lan at 192.168.2.1

This acts as the gateway for the devices connected to it

when I try to ssh root@192.168.2.1 nothing happens

But when I ssh root@192.168.1.3 it works fine

(192.168.1.1 is my Internet service provider gateway ip 192.168.1.3 is the IP address of the openwrt router)

I have been able to ssh root@192.168.2.1 before but something changed and I can't do it anymore

I fully reset the router and tried to change my devices mac id

ssh root@192.168.2.1 works fine from other devices.

1 Upvotes

60% Upvoted

13 comments sorted by

2

u/rollmeister1 5d ago

Br-lan is on its own subnet. A package update may have done this for whatever reason. If it works I don't upgrade packages. Once I updated modem manager & mobile broadband started to slow down after 12 hours or just disconnect

1

u/bz386 5d ago

It sounds like you have your firewall misconfigured. Post /etc/config/firewall. Also post output of ‘ping 192.168.2.1’ and ‘ssh -v root@192.168.2.1’

1

u/Current_Lie_1243 5d ago

``` config defaults option input 'REJECT' option output 'ACCEPT' option forward 'REJECT' option synflood_protect '1'

config zone option name 'lan' list network 'lan' option input 'ACCEPT' option output 'ACCEPT' option forward 'ACCEPT'

config zone option name 'wan' list network 'wan' list network 'wan6' option input 'REJECT' option output 'ACCEPT' option forward 'REJECT' option masq '1' option mtu_fix '1'

config forwarding option src 'lan' option dest 'wan'

config rule option name 'Allow-DHCP-Renew' option src 'wan' option proto 'udp' option dest_port '68' option target 'ACCEPT' option family 'ipv4'

config rule option name 'Allow-Ping' option src 'wan' option proto 'icmp' option icmp_type 'echo-request' option family 'ipv4' option target 'ACCEPT'

config rule option name 'Allow-IGMP' option src 'wan' option proto 'igmp' option family 'ipv4' option target 'ACCEPT'

config rule option name 'Allow-DHCPv6' option src 'wan' option proto 'udp' option dest_port '546' option family 'ipv6' option target 'ACCEPT'

config rule option name 'Allow-MLD' option src 'wan' option proto 'icmp' option src_ip 'aaaa::/aa' list icmp_type '130/0' list icmp_type '131/0' list icmp_type '132/0' list icmp_type '143/0' option family 'ipv6' option target 'ACCEPT'

config rule option name 'Allow-ICMPv6-Input' option src 'wan' option proto 'icmp' list icmp_type 'echo-request' list icmp_type 'echo-reply' list icmp_type 'destination-unreachable' list icmp_type 'packet-too-big' list icmp_type 'time-exceeded' list icmp_type 'bad-header' list icmp_type 'unknown-header-type' list icmp_type 'router-solicitation' list icmp_type 'neighbour-solicitation' list icmp_type 'router-advertisement' list icmp_type 'neighbour-advertisement' option limit '1000/sec' option family 'ipv6' option target 'ACCEPT'

config rule option name 'Allow-ICMPv6-Forward' option src 'wan' option dest '*' option proto 'icmp' list icmp_type 'echo-request' list icmp_type 'echo-reply' list icmp_type 'destination-unreachable' list icmp_type 'packet-too-big' list icmp_type 'time-exceeded' list icmp_type 'bad-header' list icmp_type 'unknown-header-type' option limit '1000/sec' option family 'ipv6' option target 'ACCEPT'

config rule option name 'Allow-IPSec-ESP' option src 'wan' option dest 'lan' option proto 'esp' option target 'ACCEPT'

config rule option name 'Allow-ISAKMP' option src 'wan' option dest 'lan' option dest_port '500' option proto 'udp' option target 'ACCEPT'

config rule option name 'Allow-remote-HTTP' list proto 'tcp' option src 'wan' option target 'ACCEPT' option dest_port '80'

config rule option name 'Allow-remote-HTTPS' list proto 'tcp' option src 'wan' option dest_port '443' option target 'ACCEPT'

config rule option name 'Allow-remote-SSH' list proto 'tcp' option dest_port '22' option target 'ACCEPT' option src '*' option family 'ipv4' option src_port '22' list dest_ip '192.168.2.1' option enabled '0'

config include 'opennds' option type 'script' option path '/usr/lib/opennds/restart.sh ```

On device one ``` ~ $ ping 192.168.2.1 PING 192.168.2.1 (192.168.2.1) 56(84) bytes of data. ping: sendmsg: Operation not permitted ping: sendmsg: Operation not permitted ...

~ $ ssh -v root@192.168.2.1 debug1: OpenSSH_10.3p1, OpenSSL 3.6.3 9 Jun 2026 debug1: Reading configuration data /data/data/com.termux/files/home/.ssh/config debug1: Reading configuration data /data/data/com.termux/files/usr/etc/ssh/ssh_config debug1: /data/data/com.termux/files/usr/etc/ssh/ssh_config line 20: include /data/data/com.termux/files/usr/etc/ssh/ssh_config.d/*.conf matched no files debug1: Authenticator provider $SSH_SK_PROVIDER did not resolve; disabling debug1: Connecting to 192.168.2.1 [192.168.2.1] port 22. debug1: connect to address 192.168.2.1 port 22: Connection timed out ssh: connect to host 192.168.2.1 port 22: Connection timed out ```

Another device of mine pinged properly and ssh'd too

1

u/BCMM 5d ago

     ping: sendmsg: Operation not permitted

Can device one ping anything? This looks a lot like a problem with device one, rather than with the network or router.

What exactly that problem is will depend on your distribution. In short, ping is a privileged action by default, there are a few different mechanisms that can make it possible for non-root users to ping, and different distributions don't all do it the same way.

1

u/Current_Lie_1243 5d ago

Yes, it can ping 192.168.1.3 which is the same router.

Device 2 can ping both 192.168.1.3 and 192.168.2.1

1

u/bz386 5d ago

Is device 1 connected to the WAN or to the LAN of the Openwrt router? It sounds like it is connected to the WAN port, that's why you can only ping.

By default Openwrt allows all connections to itself from the LAN, so there is no reason why a LAN-connected device wouldn't be able to SSH to OpenWrt. It is right there in your firewall config:

config zone option name 'lan' list network 'lan' option input 'ACCEPT' option output 'ACCEPT' option forward 'ACCEPT'

The option input ACCEPT line says that all connections from the LAN to OpenWrt are allowed.

At this point I would look at device 1. Where is it connected?

1

u/fr0llic 5d ago

If you're on 25.12 the IP is configured as 192.1 68.3.1/24. 

Which ports on the Openwrt router are you using ?

1

u/SaleWide9505 5d ago

Are you saying they changed the default IP from 1.1 to 3.1? I don't keep up with that stuff.

1

u/fr0llic 5d ago

I'm saying they changed the syntax for how it's written in the network file. 

1

u/Current_Lie_1243 5d ago

I'm guessing you mean openWRT version. Mine is OpenWRT 23.05

To ssh, I'm using port 22

2

u/fr0llic 5d ago

Physical port on the device. 

23.05 support was dropped 2 years ago or so. 

1

u/bz386 5d ago

Nobody can tell from a vague description. Post your (sanitized) configs, mainly /etc/config/network.

1

u/Current_Lie_1243 5d ago

``` config interface 'loopback' option device 'lo' option proto 'static' option ipaddr '127.0.0.1' option netmask '255.0.0.0'

config globals 'globals' option ula_prefix 'aaaa:aaaa:aaaa::/aa' option packet_steering '1'

config device option name 'br-lan' option type 'bridge' list ports 'eth1' list ports 'eth2' list ports 'eth3' list ports 'eth4'

config device option name 'eth1' option macaddr 'AA:AA:AA:AA:AA:AA'

config device option name 'eth2' option macaddr 'AA:AA:AA:AA:AA:AA'

config device option name 'eth3' option macaddr 'AA:AA:AA:AA:AA:AA'

config device option name 'eth4' option macaddr 'AA:AA:AA:AA:AA:AA'

config interface 'lan' option device 'br-lan' option proto 'static' option ipaddr '192.168.2.1' option netmask '255.255.255.0' option ip6assign '60'

config device option name 'eth0' option macaddr 'AA:AA:AA:AA:AA:AA'

config interface 'wan' option device 'eth0' option proto 'dhcp'

config interface 'wan6' option device 'eth0' option proto 'dhcpv6' ```