dpi for SSH protocol

[Cake]

Hello,
Does official firmware for AC68U use the trendmicro dpi to flag SSH protocol?

 

[sfx2000]

Hello,
Does official firmware for AC68U use the trendmicro dpi to flag SSH protocol?

What are you looking for?

SSH by it's nature is very secure, and DPI on a router likely doesn't have the CPU horsepower to do much with it, other than to allow/disallow connectivity, which can be done via config on the ssh daemon (dropbear in this case...)

 

[Cake]

Thanks for the reply,
I am trying to figure out why ssh protocol is not being routed through the vpn of router. Its not a port because I changed ssh ports so it must be id'd by the protocol.
I would appreciate if one of you rockstars on here can validate this.
http://www.snbforums.com/threads/ssh-and-openvpn-is-it-operator-error.30102/

 

[Cake]

On my VPS sudo watch lsof -i shows me connected at port 2222 from my ISP WAN address. Then I disconnect run curl ipecho.net/plain; echo from the same machine used to ssh and I get VPN IP.

 

[sfx2000]

So the SSH host is the router, or something behind the router?

If it's something behind the router... but why even deal with VPN, when you can just expose the SSH host directly and lock it down?

 

[Cake]

The SSH can be the router, but I have been using a device behind router (raspbian) and a desktop (mint).
I take it you don't have the same thing?
I got started with this whole mess following this tutorial, enabling password-less scp login, and locking it down a little. All the device behind my router show up on the VPS as using my ISP IP, I am expecting it to show the VPN IP. The SSH Host's I have been using behind my router are all configured to go through a public VPN. Running curl ipecho.net/plain; echo on the SSH Host's reveal my VPN IP (like expected). However when ssh into my VPS from same device, and run (now on VPS ubuntu) sudo watch lsof -i shows me I did not go through my VPN.

Edit: I want the VPN ip (ex. from="1.1.*.*") in my authorized_keys file on the VPS, not my ISP. (I know it sounds a little crazy), but this is not important, just background info- as to why SSH is not going through the VPN is way more important.

 

[sfx2000]

I have an SSH host behind the router/firewall... so it's port forwarded at the router.

So for inbound to my SSH host, I go to my WAN ip - in your case, define the port at the remote end of the VPN link, rather than the WAN IP, and you should be good to go...

 

[Cake]

I'm sorry SFX, I meant ssh client behind my router to host sshd running on vps. Its the same for minecraft, so I guess its not just ssh. If I open minecraft game from behind my router and connect to the Minecraft server running on the same vps it shows that my ISP IP is connected. Everything is supposed to go through the openvpn of router.
I might switch versions of firmware to see if its that next week. I'm currently using rmerlin's latest. AC68U
Browser and using curl from behind my router shows I am going through VPN, is there a way to test UDP protocol only?

 

[sfx2000]

SSH is TCP.... no UPD on the SSH connection, but once the tunnel is established, then one can run UDP traffic over it...

Have you considered just running SSH direct from your client to the VPS? Going to be faster, and just as secure as OpenVPN, and then no messing around with IPTables and routes...

 

[Cake]

I am at a loss. If I run openvpn straight from computer and not use the routers VPN client, ssh will use the VPN.
I have a device behind my router that fetches a file on boot using scp. I want it to use the VPN and set ssh settings for a user on vps to host='x.x.*.*'
That way if the device gets physically stolen from me and later on it gets attached to the same ISP (handing out a dynamic IP) it can't fetch the file.

Nobody else can take a couple minutes and test to confirm ssh is bypassing VPN.
Type watch ss -tp after you connect to your vps. (Using the openvpn of router)

Edit: Resolved

 

[sfx2000]

also check the -V switch... bit more debug on the connection...

ssh -V user@hostname/hostip...