Remote SSH access Issue Via NAT

RouterOS General
1

Good Day,

My Mikrotik HeX is setup with the latest RouterOS version 6.44. It gets its internet/public IP from a modem connected on the WAN port in (i believe) Bridge Mode. This external modem has an ssh service running on the public IP on default port 22. I need to NAT another port to access SSH of the Mikrotik Remotely.

  1. If I connect my Laptop via ethernet to the Mikrotik I am able to SSH into the mikrotik on is local lan ip 10.0.0.1.
  2. If I try and connect via it public IP “ssh -p7000 admin@” then it shows:

OpenSSH_7.9p1, LibreSSL 2.7.3
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 48: Applying options for *
debug2: resolve_canonicalize: hostname xx.xx.xxx.xxx is address
debug2: ssh_connect_direct
debug1: Connecting to xx.xx.xxx.xxx [xx.xx.xxx.xxx] port 7000.
debug1: Connection established.
debug1: Local version string SSH-2.0-OpenSSH_7.9
ssh_exchange_identification: read: Connection reset by peer

I do not think it is a Firewall/NAT issue as it is getting “Connection established” but then failing.

For reference the firewall config is as follows (and is move up to the top of the list):
/ip firewall nat add chain=dstnat action=dst-nat in-interface=ether1-wan protocol=tcp dst-port=7000 to-addresses=10.0.0.1 to-ports=22
/ip firewall filter add chain=input in-interface=ether1-wan protocol=tcp dst-address=10.0.0.1 dst-port=7000 comment=mikrotikssh

I appreciate any feedback?

Thanks,

2

You cannot access the external modem??

3

No, I cannot access the Mikrotik remotely.

4

??/ Mikrotik doesnt make modems??
Who setup the ssh on the modem??

5

If the modem is truly in bridge mode then you won’t be able to access it via the WAN through SSH. Your SSH should be hitting the MikroTik. This would only not be the case if it wasn’t actually in bridge mode and was routing and your MikroTIk was simply taking a LAN connection from it.

I use a modem myself and connect my MT through as it is in bridge mode. To access the modem I then use terminal from my MikroTik and SSH to the modem which has a secondary LAN port for monitoring and configurations.