impossible to connect windows 10 client machine through public ipv4

[aragon5956]

Prerequisites

• Write a descriptive title.
• Make sure you are able to repro it on the latest version
• Search the existing issues.

Steps to reproduce

hello ,
i can't to connect my windows 10 machine client , i have this version of openssh : ```
OpenSSH_for_Windows_9.5p1, LibreSSL 3.8.2
usage: sshd [-46DdeGiqTtV] [-C connection_spec] [-c host_cert_file]
[-E log_file] [-f config_file] [-g login_grace_time]
[-h host_key_file] [-o option] [-p port] [-u len]
PS C:\Program Files\OpenSSH>

my `sshd_config` in `ProgrammData`  directory is  : ```
# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

Port 2222
#AddressFamily any
ListenAddress 0.0.0.0
ListenAddress ::

#HostKey __PROGRAMDATA__/ssh/ssh_host_rsa_key
#HostKey __PROGRAMDATA__/ssh/ssh_host_dsa_key
#HostKey __PROGRAMDATA__/ssh/ssh_host_ecdsa_key
#HostKey __PROGRAMDATA__/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
SyslogFacility LOCAL0
LogLevel DEBUG

# Authentication:

#LoginGraceTime 2m
#PermitRootLogin prohibit-password
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

PubkeyAuthentication yes

# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
# but this is overridden so installations will only check .ssh/authorized_keys
AuthorizedKeysFile	.ssh/authorized_keys

#AuthorizedPrincipalsFile none

# For this to work you will also need host keys in %programData%/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication yes
#PermitEmptyPasswords no

# GSSAPI options
#GSSAPIAuthentication no

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
#PermitTTY yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#PermitUserEnvironment no
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS no
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none

# no default banner path
#Banner none

# override default of no subsystems
Subsystem	sftp	sftp-server.exe

# Example of overriding settings on a per-user basis
#Match User anoncvs
#	AllowTcpForwarding no
#	PermitTTY no
#	ForceCommand cvs server

Match Group administrators
       AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys

could you help me ?
Regards

Expected behavior

connected with success

Actual behavior

timeout

Error details

No response

Environment data

windows 10 lastest build : 19045.5011

Version

OpenSSH_for_Windows_9.5p1, LibreSSL 3.8.2

Visuals

20241013144552.mp4

[tgauth]

Can you run ipconfig in terminal and ensure that IPV4 address is correct?

[aragon5956]

It's a public ipv4 !! not private!!

[tgauth]

Can you check the firewall rules and make sure sshd can accept incoming connections on public networks?

[aragon5956]

I will try as soon as , it's vert strangely because even i disable firewall, i Can't connect through public ipv4 ,on 22 port pr 2222 , but inwill verify again
Regards

[Chao216]

got same issue

ltsc 24h2
lastest GitHub Release, installed by ps1 script

turn off firewall completely， connect
turn on firewall, timed out

[tgauth]

@Chao216 did you verify the firewall rules to ensure sshd can accept incoming connections on public networks?

[Chao216]

Hi @tgauth,

A weird thing is that i found on some Old os, install open ssh server will automatically add a firewall inbound rule allow port 22 ,
vice versa.

but new windows seems don't behave like that, I have to manually add firewall inbound rule.

regarding permissions for log folder, I used a local admin account, could not open and got uac prompt, this cause the later on ssh server break (restart 1607 error), a question I would like to know is as i set System and administrators to have full control, why my account (member of administrators) can't access log folder by default?

[tgauth]

Hi @tgauth,

A weird thing is that i found on some Old os, install open ssh server will automatically add a firewall inbound rule allow port 22 , vice versa.

but new windows seems don't behave like that, I have to manually add firewall inbound rule.

Yes - newer Windows versions still create a firewall rule, but only for private networks.

regarding permissions for log folder, I used a local admin account, could not open and got uac prompt, this cause the later on ssh server break (restart 1607 error), a question I would like to know is as i set System and administrators to have full control, why my account (member of administrators) can't access log folder by default?

Technically, the check is for the SYSTEM and Administrators group SIDs so that is why the account, although administrator, is rejected. We're working on updating this, but in the meantime, if you navigate to the log folder via terminal, the user can still view the logs without the ACLs being modified by file explorer.

[aragon5956]

Pouvez-vous vérifier les règles du pare-feu et vous en assurer sshdpeut-on accepter les connexions entrantes sur les réseaux publics?
i have a another firewall , it GDATA internet security solution , and, even i disabled the firewall i can't connect myself through ipv4

Can you check the firewall rules and make sure sshd can accept incoming connections on public networks?

i can only with private netwok , i've tested it

[aragon5956]

Can you check the firewall rules and make sure sshd can accept incoming connections on public networks?

i cant only private ip like 192.168.1.x or localhost , and i listen on 0.0.0.0 on 2222 port
regards

[Chao216]

Hi @tgauth,

A weird thing is that i found on some Old os, install open ssh server will automatically add a firewall inbound rule allow port 22 , vice versa.

but new windows seems don't behave like that, I have to manually add firewall inbound rule.

Yes - newer Windows versions still create a firewall rule, but only for private networks.

regarding permissions for log folder, I used a local admin account, could not open and got uac prompt, this cause the later on ssh server break (restart 1607 error), a question I would like to know is as i set System and administrators to have full control, why my account (member of administrators) can't access log folder by default?

Technically, the check is for the SYSTEM and Administrators group SIDs so that is why the account, although administrator, is rejected. We're working on updating this, but in the meantime, if you navigate to the log folder via terminal, the user can still view the logs without the ACLs being modified by file explorer.

reverted permissions full control back to Nt system and administrators, if i use elevated CMD or PowerShell prompt,can cd into log folder and cat the log content.

Maybe an elevated Explorer process will be able to access just like the CLI environment

[aragon5956]

Can you run ipconfig in terminal and ensure that IPV4 address is correct?

I have another problem waiting and I do not know how to solve it : #1176

or
most recently : #2290

[aragon5956]

Can you check the firewall rules and make sure sshd can accept incoming connections on public networks?

Do you want video proof ,as i solve others problem , about firewall and ssh port ?