2

I know the steps to ssh into an EC2 instance. But I think my college firewall is blocking port 22.

Is there any way to connect to my instance without requesting the admin guys?

What can I do to figure out what is blocking me?

3
  • Change the port SSH is listening on on your server?
    – Ryan Weir
    Jul 30, 2013 at 0:13
  • Also make sure you can already connect in a non-firewalled environment before jumping to the conclusion of network firewall rules.
    – Ryan Weir
    Jul 30, 2013 at 0:14
  • I can connect in an non-firewalled environment. I double checked the security group settings before asking the question
    – user1616238
    Jul 30, 2013 at 15:47

2 Answers 2

2

As was suggested, in comments, you should verify whether the problem is at the near end or the far end. The tcptraceroute utility is an appropriate tool for this.

$ sudo tcptraceroute hostname_or_ip 22

This tries to set up TCP connections to the destination port (22) but sets the IP time-to-live (TTL) flag at artificially low values (starting at 1, then incrementing by 1) to prompt each router your connect attempt encounters to reject the packet back to you because it has essentially concluded that the packet has passed through too many routers and should no longer be forwarded.

This doesn't always work properly (due to non-compliant IP stacks in some network hardware) so a good test of whether the tool is useful from your location would be this:

$ sudo tcptraceroute google.com 80

If you get what looks like a valid trace on this request, then you can have pretty good confidence in the validity of the test for SSH.

There are other ways to tunnel into an ec2 instance or configure it to listen on another port, although if you are being blocked by your local LAN you may likely find that these methods are blocked also... and, reconfiguring your instance will be tricky if you can't SSH to it.

If you are spinning up a new instance, though, there is a way to customize it as it boots.

The EC2 User Data window that you see in the AWS console when you are launching an instance gives you an opportunity to run a custom script the first time the instance boots.

If the first line of this begins with a shebang (#!) then EC2 assumes it's a shell script. Start this file with #!/bin/bash and the rest of it will be executed on first boot. You could use this to tweak /etc/ssh/sshd_config for example, to configure sshd to listen on a port other than 22 (for example, 2222), then restart sshd. This could be accomplished by including something like this in your User Data.

#!/bin/bash

/usr/bin/perl -pi -e 's/^Port\s+22$/Port 2222/' /etc/ssh/sshd_config
/usr/sbin/service sshd restart

The sshd service would then be listening on port 2222 instead of port 22, if that helps.

You could also get creative and use this functionality to install and configure pptpd, for example, which would allow you to tunnel into the server with the point-to-point tunneling protocol... however, for PPTP to work in EC2, you have to launch the instance in a VPC, because Classic EC2 security groups only allow TCP, UDP, and ICMP. For PPTP to work, you have to be able to open all protocols to your instance -- PPTP requires the Generic Route Encapsulation (GRE) protocol in order to transport your tunneled data. GRE is IP but it is neither TCP nor UDP so it isn't possible to use it in Classic EC2.

Also, iirc, the User Data trick only works when the instance is initially launched.

2

To test if your college firewall is blocking TCP 22, try www.ismyportblocked.com

IsMyPortBlocked tests for blocked OUTBOUND ports that might be filtered/blocked by a firewall.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.