Unable to access repositories with SSH from certain networks #2179

greenukworks commented 2025年10月19日 17:16:58 +02:00

Comment

Hi,

I am trying to access a repository via SSH from within a Pod (for Flux), but although it works fine on my local machine I am unable to connect from other places. The connection just hangs and times out, so never gets as far as attempting authentication.

debug1: OpenSSH_10.0p2, OpenSSL 3.5.0 8 Apr 2025
debug3: Running on Linux 6.17.2-1-default #1 SMP PREEMPT_DYNAMIC Sun Oct 12 17:26:11 UTC 2025 (d07fa64) x86_64
debug3: Started with: ssh -vvvvvv -o SendEnv=GIT_PROTOCOL git@codeberg.org "git-upload-pack \\'/the-organisation/deployments.git\\'"
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 22: include /etc/ssh/ssh_config.d/*.conf matched no files
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> '/root/.ssh/known_hosts'
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> '/root/.ssh/known_hosts2'
debug2: resolving "codeberg.org" port 22
debug3: resolve_host: lookup codeberg.org:22
debug3: channel_clear_timeouts: clearing
debug3: ssh_connect_direct: entering
debug1: Connecting to codeberg.org [217.197.84.140] port 22.
debug3: set_sock_tos: set socket 3 IP_TOS 0x48
debug1: connect to address 217.197.84.140 port 22: Operation timed out
debug1: Connecting to codeberg.org [2a0a:4580:103f:c0de::1] port 22.
debug3: set_sock_tos: set socket 3 IPV6_TCLASS 0x48
debug1: connect to address 2a0a:4580:103f:c0de::1 port 22: Network unreachable
ssh: connect to host codeberg.org port 22: Network unreachable
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.

DNS seems to be working, and I can curl the codeberg homepage from within the Pod.

Is there anything else I should be checking?

### Comment Hi, I am trying to access a repository via SSH from within a Pod (for Flux), but although it works fine on my local machine I am unable to connect from other places. The connection just hangs and times out, so never gets as far as attempting authentication. ``` debug1: OpenSSH_10.0p2, OpenSSL 3.5.0 8 Apr 2025 debug3: Running on Linux 6.17.2-1-default #1 SMP PREEMPT_DYNAMIC Sun Oct 12 17:26:11 UTC 2025 (d07fa64) x86_64 debug3: Started with: ssh -vvvvvv -o SendEnv=GIT_PROTOCOL git@codeberg.org "git-upload-pack \\'/the-organisation/deployments.git\\'" debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 22: include /etc/ssh/ssh_config.d/*.conf matched no files debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> '/root/.ssh/known_hosts' debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> '/root/.ssh/known_hosts2' debug2: resolving "codeberg.org" port 22 debug3: resolve_host: lookup codeberg.org:22 debug3: channel_clear_timeouts: clearing debug3: ssh_connect_direct: entering debug1: Connecting to codeberg.org [217.197.84.140] port 22. debug3: set_sock_tos: set socket 3 IP_TOS 0x48 debug1: connect to address 217.197.84.140 port 22: Operation timed out debug1: Connecting to codeberg.org [2a0a:4580:103f:c0de::1] port 22. debug3: set_sock_tos: set socket 3 IPV6_TCLASS 0x48 debug1: connect to address 2a0a:4580:103f:c0de::1 port 22: Network unreachable ssh: connect to host codeberg.org port 22: Network unreachable fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists. ``` DNS seems to be working, and I can curl the codeberg homepage from within the Pod. Is there anything else I should be checking?

Gusted commented 2025年10月19日 18:51:52 +02:00

Is it possible this might be a firewall issue on your side? It would be good check if you're able to access Github or Gitlab via SSH.

Is it possible this might be a firewall issue on your side? It would be good check if you're able to access Github or Gitlab via SSH.

greenukworks commented 2025年10月19日 20:27:39 +02:00

That was it, sorry, didn't realise there were outbound rules in place.

Thank you.

That was it, sorry, didn't realise there were outbound rules in place. Thank you.