connect to ssh from Internet

RouterOS General
1

Hello,

I have the following setup:
an Internet router (TP-Link) that handles PPOE, port forwarding and firewall (192.168.1.1). Behind it is the MikroTik RB751G, Router OS version 5.11 which serves as DHCP server and wireless AP (192.168.1.5) on the intranet. It is to this MikroTik that all my computers and devices connect to.

My firewall rules on the MikroTik - the firewall should actually be disabled:

0 ;;; default configuration
chain=input action=accept protocol=icmp
1 ;;; default configuration
chain=input action=accept connection-state=established
2 ;;; default configuration
chain=input action=accept connection-state=related
3 X ;;; default configuration
chain=input action=drop in-interface=ether1-gateway

The SSH server settings on the MT:

3 ssh 22

When connecting to MikroTik’s SSH server from within the intranet, all works perfectly.
The problem is that when forwarding SSH connections to MikroTik from Internet (i.e. the TP-Link), MT doesn’t answer those connections. I can see in IP-Firewall-Connections on the web interface of MT that they are correctly forwarded from the TP-Link, but the MikroTik simply doesn’t answer them. As far as I understand it, they shouldn’t be blocked by the firewall itself (see rules).

I have a similar setup when the SSH connections are forwarded to a different device on the network and everything works fine there.

What am I missing? Is there a way to make the MikroTik’s SSH server accept connections from the Internet with my particular hardware and version?
If any more information are necessary, let me know.

Thanks.

PS: Although this seems similar to http://forum.mikrotik.com/t/enable-ssh-winbox-telnet-with-5-x-os/54079/1 , I didn’t find that post helpful in resolving my issue.

2

Those rules are dropping all input flows except ICMP, ESTABLISHED and RELATED on Ether 1. You need to add an accept rule for SSH - i.e. for the port it is using.

3

Fair enough. I have added a rule, here is the updated listing:

0 ;;; default configuration
chain=input action=accept protocol=icmp

1 ;;; default configuration
chain=input action=accept connection-state=established

2 ;;; default configuration
chain=input action=accept connection-state=related

3 chain=input action=accept protocol=tcp dst-port=22

4 ;;; default configuration
chain=input action=drop in-interface=ether1-gateway

And here the changed service definition - explicitly opened from every source (I believe) :

3 ssh 22 0.0.0.0/0

However, the connections are still not accepted. Am I doing something wrong?

Thanks a lot for your time.

4

These look OK. Make sure that you have a default route from the Mikrotik heading towards the TP-Link. If that is OK post your config - output from /export compact.

5

@CelticComms Thanks, adding route for all addresses to the TP-Link finally solved the problem. Again, thanks a lot. When I figure out how to add karma (?), I will.