72 lines
No EOL
2.1 KiB
Markdown
72 lines
No EOL
2.1 KiB
Markdown
---
|
|
title: Stalled SSH connections
|
|
summary: >
|
|
My pfSense removed valid connections obviosly.
|
|
This is how I solved it.
|
|
<small>The thumbnail was created with Google AI (Imagen 3).</small>
|
|
date: 2024-10-06T19:30:17+02:00
|
|
lastmod: 2025-01-05T09:03:01+0000
|
|
categories:
|
|
- computerstuff
|
|
tags:
|
|
- networking
|
|
- pfSense
|
|
- openssh
|
|
- selfhost
|
|
---
|
|
|
|
I spent some time adjusting my SSH configuration because I often get stalled
|
|
connections to my servers but I never got that fixed until recently, when I
|
|
started looking in my firewall settings on the pfSense.
|
|
|
|
After changing the <kbd>Firewall Optimization Settings</kbd> within
|
|
<kbd>System</kbd> → <kbd>Advanced</kbd> → <kbd>Firewall & NAT</kbd> to
|
|
<kbd>Conservative</kbd> I had no more of these hangs of my SSH sessions.
|
|
|
|
|
|
|
|
I use the `ControlMaster` setting in my SSH configuration so the stalled
|
|
connections have to be killed with something like
|
|
|
|
```console
|
|
$ ssh -O exit {short hostname}
|
|
```
|
|
|
|
every time -- which is annoying.
|
|
|
|
{{< alert "triangle-exclamation" >}}
|
|
**Update on December 17 2024:**
|
|
A few changes to the SSH configuration on client and server have been made.
|
|
{{< /alert >}}
|
|
|
|
It got better, but I still experience the one or other hang.
|
|
|
|
I added/modified these entries within `Host *` in
|
|
<kbd>~/.ssh/config</kbd> on the client:
|
|
|
|
```apache
|
|
ServerAliveInterval 100
|
|
ServerAliveCountMax 10000
|
|
```
|
|
|
|
and made these changes/additions in <kbd>/etc/ssh/sshd_config</kbd>
|
|
on the server:
|
|
|
|
```apache
|
|
ClientAliveInterval 60
|
|
ClientAliveCountMax 10000
|
|
TCPKeepAlive yes
|
|
```
|
|
|
|
{{< alert "triangle-exclamation" >}}
|
|
**Update on January 5 2025:**
|
|
Another change to the firewall setup in my home network.
|
|
{{< /alert >}}
|
|
|
|
I did not had this on my mind but I accidentally saw my firewall retrieving
|
|
a blacklist from my server and like instantly my ssh session was unusable again.
|
|
|
|
I now reduced the amount of updates the firewall retrieves the blacklist and hope
|
|
for the best!
|
|
|
|
 |