通过 ssh 进入连接到 DSlite 连接的 FRITZ!Box 后面的 TrueNAS 不起作用，我总是收到“连接被拒绝”的消息。
在放置 TrueNAS 的 LAN 内，Web 和 ssh 可按预期工作。此外，通过 dyndns 服务 (myfritz) 到 FRITZ!Box 和 TrueNAS 的 Web 连接也可通过浏览器按预期工作。
操作系统：在 Fedora 35、Debian、Windows 10 和不同网络中进行了测试
规格和设置：
Fritz box: 4712
FRITZ!OS: 06.87
TrueNAS-12.0-U8.1
ipv6: connected
ipv4: connected over DS-Lite-Tunnel
dynDNS: myfritz service
Fritz!Box port sharing:
device: truenas
IPv4: 192.168.178.25
IPv6: ::7285:c2ff:fe29:8a45
Shares:
ipv4 HTTPS-Server -> port 443
ipv4 SSH -> port 22
ipv6 HTTPS-Server -> port 443
ipv6 SSH -> port 22
Self contained port sharing: enabled, but zero active
Exposed Host option for v4 and v6 -> disabled
通过局域网 SSH（按预期工作）：
ssh -l root -i ~/.ssh/id_ecdsa -p 22 truenas-> 正确的 ssh 登录
通过互联网进行 SSH（由于 DSLite，因此仅限 ipv6）：
ssh -l root -i ~/.ssh/id_ecdsa -p 22 -6 2001:9e8:x:xxxx:xxxx:xxxx:fe29:8a45->连接被拒绝
以下是详细 ssh 的输出
ssh -vvv -l root -i ~/.ssh/id_ecdsa -p 22 -6 2001:9e8:x:xxxx:xxxx:xxxx:fe29:8a45
OpenSSH_8.7p1, OpenSSL 1.1.1n FIPS 15 Mar 2022
debug1: Reading configuration data /home/rob/.ssh/config
debug1: /home/rob/.ssh/config line 1: Applying options for *
debug1: Reading configuration data /etc/ssh/ssh_config
debug3: /etc/ssh/ssh_config line 55: Including file /etc/ssh/ssh_config.d/50-redhat.conf depth 0
debug1: Reading configuration data /etc/ssh/ssh_config.d/50-redhat.conf
debug2: checking match for 'final all' host 2001:9e8:x:xxxx:xxxx:xxxx:fe29:8a45 originally 2001:9e8:x:xxxx:xxxx:xxxx:fe29:8a45
debug3: /etc/ssh/ssh_config.d/50-redhat.conf line 3: not matched 'final'
debug2: match not found
debug3: /etc/ssh/ssh_config.d/50-redhat.conf line 5: Including file /etc/crypto-policies/back-ends/openssh.config depth 1 (parse only)
debug1: Reading configuration data /etc/crypto-policies/back-ends/openssh.config
debug3: gss kex names ok: [gss-curve25519-sha256-,gss-nistp256-sha256-,gss-group14-sha256-,gss-group16-sha512-]
debug3: kex names ok: [curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512]
debug1: configuration requests final Match pass
debug2: resolve_canonicalize: hostname 2001:9e8:x:xxxx:xxxx:xxxx:fe29:8a45 is address
debug1: re-parsing configuration
debug1: Reading configuration data /home/rob/.ssh/config
debug1: /home/rob/.ssh/config line 1: Applying options for *
debug1: Reading configuration data /etc/ssh/ssh_config
debug3: /etc/ssh/ssh_config line 55: Including file /etc/ssh/ssh_config.d/50-redhat.conf depth 0
debug1: Reading configuration data /etc/ssh/ssh_config.d/50-redhat.conf
debug2: checking match for 'final all' host 2001:9e8:x:xxxx:xxxx:xxxx:fe29:8a45 originally 2001:9e8:x:xxxx:xxxx:xxxx:fe29:8a45
debug3: /etc/ssh/ssh_config.d/50-redhat.conf line 3: matched 'final'
debug2: match found
debug3: /etc/ssh/ssh_config.d/50-redhat.conf line 5: Including file /etc/crypto-policies/back-ends/openssh.config depth 1
debug1: Reading configuration data /etc/crypto-policies/back-ends/openssh.config
debug3: gss kex names ok: [gss-curve25519-sha256-,gss-nistp256-sha256-,gss-group14-sha256-,gss-group16-sha512-]
debug3: kex names ok: [curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512]
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> '/home/rob/.ssh/known_hosts'
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> '/home/rob/.ssh/known_hosts2'
debug3: ssh_connect_direct: entering
debug1: Connecting to 2001:9e8:x:xxxx:xxxx:xxxx:fe29:8a45 [2001:9e8:x:xxxx:xxxx:xxxx:fe29:8a45] port 22.
debug3: set_sock_tos: set socket 3 IPV6_TCLASS 0x48
debug1: connect to address 2001:9e8:x:xxxx:xxxx:xxxx:fe29:8a45 port 22: Network is unreachable
ssh: connect to host 2001:9e8:x:xxxx:xxxx:xxxx:fe29:8a45 port 22: Network is unreachable
非常感谢您的帮助。谢谢
答案1
tl;dr：解决方案：在 TrueNAS 的服务部分的 SSH 设置中启用选项“允许 TCP 端口转发”。
我强制 ssh 在本地网络中使用 ipv6 进行测试，发现本地网络中的连接也被拒绝。所以很明显 TrueNAS 本身存在 ipv6 问题。除了允许 TCP 端口转发外，我找不到任何其他看起来很有希望的 SSH 服务设置。这立即解决了问题。
PS：正确检测错误的问题之一是我的手机提供商根本不提供 IPv6，而且我一开始没有注意到它，因为我无法想象 2022 年会发生这样的事情。