Forwarded connection refused by server, using the SSH tunnel

[Chira]

Router AC68U
I have a worked network model before upgrade from 378.55 to 378.56(_0/_2)
Workstation (Putty) -> (SSH tunnel over http proxy) -> Router -> Internet
After Firmware upgrade I receive error:
Opening connection to www.google.com:443 for forwarding
Forwarded connection refused by server: Connect failed []

The connection refused not for all sites.

My options are:
Enable Telnet : No
Enable SSH : Yes
Allow SSH Port Forwarding : Yes
SSH service port : 443
Allow SSH access from WAN : Yes
Allow SSH password login : No
Enable SSH Brute Force Protection : No
SSH Authentication key : some key code

 

[CiscoX]

Router AC68U
I have a worked network model before upgrade from 378.55 to 378.56(_0/_2)
Workstation (Putty) -> (SSH tunnel over http proxy) -> Router -> Internet
After Firmware upgrade I receive error:
Opening connection to www.google.com:443 for forwarding
Forwarded connection refused by server: Connect failed []

The connection refused not for all sites.

My options are:
Enable Telnet : No
Enable SSH : Yes
Allow SSH Port Forwarding : Yes
SSH service port : 443
Allow SSH access from WAN : Yes
Allow SSH password login : No
Enable SSH Brute Force Protection : No
SSH Authentication key : some key code

Hi,

You could try another SSH service port.
I could cause problem if you also are using port 443 to login to your router, like https://
So try another SSH port

 

[Chira]

I have changed SSH port to 8443, but a situation still the same, no changes.

 

[john9527]

Port 8443 is the default port for https access to the gui...possible port conflict?
BTW....port 443 is reserved for AICloud....

 

[Chira]

I have changed port for AICloud to 8843, and checked netstat. There are no any others listening proceses on the 443 and 8443 ports.
And part of https requests works normaly:
Opening connection to www.google.com:443 for forwarding
Opening connection to www.google.com:443 for forwarding
Forwarded connection refused by server: Connect failed []
Forwarded connection refused by server: Connect failed []
Opening connection to www.google.com:443 for forwarding
Forwarded connection refused by server: Connect failed []
Opening connection to www.google.com:443 for forwarding
Opening connection to metalink.oracle.com:80 for forwarding
Opening connection to metalink.oracle.com:80 for forwarding
Forwarded connection refused by server: Connect failed []
Opening connection to support.oracle.com:443 for forwarding
Opening connection to support.oracle.com:443 for forwarding
Forwarded port closed
Forwarded port closed
Opening connection to support.oracle.com:443 for forwarding
Opening connection to support.oracle.com:443 for forwarding
Opening connection to support.oracle.com:443 for forwarding
Opening connection to support.oracle.com:443 for forwarding

Requests to google - refused
Requests to oracle - confirmed

 

[BWR]

Does telnetting to the configured SSH port work? It should like something like:

$ telnet 192.168.1.1 22

Trying 192.168.1.1...

Connected to router.asus.com.

Escape character is '^]'.

SSH-2.0-dropbear_2014.66

??|SMz\ϙ???'|?curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,kexguess2@matt.ucc.asn.au#ecdsa-sha2-nistp521,ssh-rsa,ssh-dssgaes128-ctr,3des-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes256-cbc,twofish256-cbc,twofish-cbc,twofish128-cbcgaes128-ctr,3des-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes256-cbc,twofish256-cbc,twofish-cbc,twofish128-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1-96,hmac-sha1,hmac-md5;hmac-sha2-256,hmac-sha2-512,hmac-sha1-96,hmac-sha1,hmac-md5nonenone???=K??

 

[john9527]

How are you testing? If you are accessing via Chrome, can you try a different browser.

 

[Chira]

Yes, I'm using Chrome. I have the same configuration on the another router WRT54GL (with dd-wrt firmware) and it works via Chrome.
Chrome is configured for using socked proxy:
AdditionalParameters=--proxy-server="socks5://localhost:5150"

telnet 192.168.2.1 8443
return:
SSH-2.0-dropbear_2015.68
☻¶☻в╖ше☻5е┘s эяUЮ╣H`╘жcur......

 

[john9527]

Did you try with a different browser?

 

[Chira]

I have tried Mozilla Firefox, the same situation.

 

[ydc]

I don't know if it's due to some auto formatting in the forum, but I noticed (at least in Tapatalk) that the Google log entry shows up as a hyperlink http://www.google.com:443 and the oracle log entries don't. If it's not just a formatting issue, the Google link looks wrong as the protocol should be HTTPS and not HTTP.

Sent from my Nexus 6 using Tapatalk

 

[Chira]

As I understand, there are no differences, from SSH tunnel point of view, what kind of TCP protocols are forwarding.
HTTPS or HTTP says browser to use or not encryption.
The problem may be related with dropbear upgrade from 2014.66 to 2015.68 version.
I have flashed back to 378.55 and functionality has been returned.

 

[ydc]

My point regarding the Google URL was really more that Google wouldn't be listening for unencrypted http traffic on port 443. The server listening on port 443 would expect to be doing a SSL/TLS handshake and the browser doesn't initiate such a handshake for unencrypted http.

Probably not relaxer but thought I'd throw it out there in case there really was a mismatch between the http protocol specified and the port number being used.

Sent from my Nexus 6 using Tapatalk

 

[Lost Dog]

I'm seeing this issue as well. I'm using a random port in the high 20000's as my ssh port and I still get this issue. It only occurs when I visit a site that uses https.

 

[Chira]

....

I'm glad to see you in our club. I'm not alonе.

 

[Jeff146]

I have the same situation too, anyone have a fix, would a downgrade work?

 

[Chira]

Till now there are no good news
I don't know how to fix this bug (may be feature)
I returned to previous firmware version.

 

[Chira]

I found such descriptions in the Change logs:
From Merlin
378.56 Beta 1 (12-Oct-2015)
- CHANGED: Updated dropbear to 2015.68 + upstream patches

From dropbear
2015.71 - 3 December 2015
- Fix crash on exit when -p address: port is used, broke in 2015.68
2015.69 - 25 November 2015
- Fix crash when forwarded TCP connections fail to connect (bug introduced in 2015.68)

May be this is our incident.

In the 380.57 changelog Merlin wrote:
- CHANGED: Updated dropbear to 2015.70.

There is a hope.

 

[Etz]

May be this is our incident.
In the 380.57 changelog Merlin wrote:
- CHANGED: Updated dropbear to 2015.70.

There is a hope.

https://github.com/RMerl/asuswrt-merlin/commit/a84cacea98a53a1eb9ece1308b440e30d5950547

dropbear: Downgraded to 2015.66, every release since then has been broken one way or another

 

[RMerlin]

https://github.com/RMerl/asuswrt-merlin/commit/a84cacea98a53a1eb9ece1308b440e30d5950547

Kong did the same downgrade (except to 2015.67) in DD-WRT, for the same reasons. 68 through 71 releases have all been borked in some way.