External SSH

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 17:47, 16 November 2005 (edit)
84.171.190.134 (Talk)
(How to set up SSH access from internet - + dynamic port)
← Previous diff
Revision as of 20:48, 13 January 2006 (edit) (undo)
169.237.154.103 (Talk)
(How to set up SSH access from internet)
Next diff →
Line 6: Line 6:
* Enable SSHD on the [[Web_Interface]] (''Administration'' -> ''Management'' or ''Services'') and don't forget to ''Save Settings''. * Enable SSHD on the [[Web_Interface]] (''Administration'' -> ''Management'' or ''Services'') and don't forget to ''Save Settings''.
-* Create a port forward rule on the web interface (''Applications & Gaming'' -> ''Port Range Forward'') to your router's local ip:+* Recommend also to change the SSHD port to something non-standard above 1024. The reason for this is, there are MANY brute-force attack tools out there that scan ranges of IP looking on port 22. If they see a response they do a brute-force attempt with a list of passwords. If your password is "admin" you are likely to be in trouble. Easy way to avoid being on their radar is CHANGE THIS DEFAULT PORT.
- ssh | 22 | 22 | tcp | 192.168.1.1 | x+
- +
- ''(for 192.168.1.1 set your router's local ip)''+
* To allow access to the SSH port from WAN add the following rule as command on the [[Web_Interface]] (''Administration'' -> ''Diagnostics'') and save with ''Save Firewall'': * To allow access to the SSH port from WAN add the following rule as command on the [[Web_Interface]] (''Administration'' -> ''Diagnostics'') and save with ''Save Firewall'':
/usr/sbin/iptables -I INPUT 1 -p tcp --dport $(nvram get sshd_port) -j logaccept /usr/sbin/iptables -I INPUT 1 -p tcp --dport $(nvram get sshd_port) -j logaccept
-* To log into your router from a windows machine you could use [http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html Putty]. You will have to enter the external ip of your router or the DynDNS name to login from Internet.+* To log into your router from a windows machine you could use [http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html Putty]. You will have to enter the external ip of your router or the DynDNS name to login from Internet. If you have changed the port on which sshd runs, you will have to fill in that port number.
=Warning!= =Warning!=

Revision as of 20:48, 13 January 2006

You are here: Main Page/DD-WRT Docu (EN)/SSH access from internet

How to set up SSH access from internet

To make it possible to access your router from internet by SSH follow these steps:

  • Enable SSHD on the Web_Interface (Administration -> Management or Services) and don't forget to Save Settings.
  • Recommend also to change the SSHD port to something non-standard above 1024. The reason for this is, there are MANY brute-force attack tools out there that scan ranges of IP looking on port 22. If they see a response they do a brute-force attempt with a list of passwords. If your password is "admin" you are likely to be in trouble. Easy way to avoid being on their radar is CHANGE THIS DEFAULT PORT.
  • To allow access to the SSH port from WAN add the following rule as command on the Web_Interface (Administration -> Diagnostics) and save with Save Firewall:
/usr/sbin/iptables -I INPUT 1 -p tcp --dport $(nvram get sshd_port) -j logaccept
  • To log into your router from a windows machine you could use Putty. You will have to enter the external ip of your router or the DynDNS name to login from Internet. If you have changed the port on which sshd runs, you will have to fill in that port number.

Warning!

It's not too secure to set up SSH access like that. Be sure to choose a long and secure password or even better use Public Key Method. Otherwise someone could succeed to hack your router by a Brute Force Attack.


You are here: Main Page/DD-WRT Docu (EN)/SSH access from internet