Problems with SSH through MikroTIK

RouterOS General
1

Hello,

I have a very strange issue with SSH. My all computers at home runs linux and when I try to open SSH session from laptop’s Gnome terminal to other computer, my SSH session just hang after successful login. Ok, I can blame linux here, but:

  1. SSH works with PuTTY even through MikroTIK
  2. SSH work to other computer through Gnome terminal when two computers connected directly (not using MikroTIK).

I have checked packet sniffer and saw that packets go and return successfuly on port 22.
Laptop ----> MikroTIK ----> linux PC
linux PC ----> MikroTIK ----> Laptop

So it seems linux installation is ok, firewall is ok (PuTTY is working right). I googled about this problem, but find nothing which applies to me, because all problems was about not up to date SSH or Gnome terminal problem. These are not my problems because directly with two computers everything is ok. Also I have tried OpenVPN tunneling to other linux device and SSH also works from Gnome terminal through tunnel. So I’m out of ideas. Packed are not dropped, firewall correct, computers are also correct, PuTTY works correct. What might be the problem then ?

2

Ok, I’ll try to explain situation more detail and maybe get any help then. The problem is that my WiFi and LAN are on separate networks and so when my SSH client is on WiFI and SSH server is on LAN side I get packets return with source address of router. My network configuration is as follows:

LAN
---
Network: 192.168.5.0/24
Gateway: 192.168.5.254

WiFi
----
Network: 172.16.5.0/20
Gateway: 172.16.5.254

SSH server
----------
IP: 192.168.5.6
Mask: 255.255.255.0
Gateway: 192.168.5.254

SSH client
----------
IP: 172.16.5.109
Mask: 255.255.240.0
Gateway: 172.16.5.254

So I have noticed that packets goes through src-nat masquerade rules and thats why I get them returned with wrong src address. So the question is not about why this configuration is not qorking, but how to make route rules and don’t use masquerade for there two networks to see each other.
Please help me with this.

3

Add out-interface parameters to your masquerade rule so that only traffic out the WAN interface gets masqueraded.

4

indeed, you should be able to use /tool sniffer to see where packets go and with what fields set.

Check your NAT, check your routes.

5

Hello,

Thanks for replies. With sniffer help I got it and now everything seems clear and now configuration seems to be good.