Hi, I think I have the same issue. 15-20s wait when ssh into my FreeBSD backup server, Don't think DNS is involved though.
I ssh from a laptop into my ubuntu file server. It has 2 nics, so I ssh again out the second to the backup server, it's behind the server. Ubuntu is set up as a bridge, with static ip backing out to the Freebsd. I can get into the FBSD box ok just pauses for ? 15 seconds every time. using ssh -v from ubuntu I find the wait happens after line `debug1: Local version string SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.11` is posted to screen and before the next line: `debug1: Remote protocol version 2.0, remote software version OpenSSH_9.3 FreeBSD-20230316` is posted to the screen.
I don't think I have any weird settings on FBSD:
Code:
backman@bub02:~ $ cat /etc/ssh/sshd_config | grep -i dns
#UseDNS yes
backman@bub02:~ $ cat /etc/ssh/sshd_config |grep -v "^#" | grep -v "^$"
AuthorizedKeysFile .ssh/authorized_keys
Subsystem sftp /usr/libexec/sftp-server
backman@bub02:~ $ ps aux | grep -i network
backman 23433 0.0 0.1 12816 2388 0 S+ 05:31 0:00.00 grep -i network
backman@bub02:~ $ exit
It happens if I try `ssh -c aes128-cbc
backman@192.168.177.2` or if I try `ssh -o Compression=no
backman@192.168.177.2`, it happens with passwordless keys, and passwords.
I think my FBSD network settings are ok,
Code:
backman@bub02:~ $ ifconfig
re0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=8209b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC,LINKSTATE>
ether 00:25:22:cc:fd:1e
inet 192.168.177.2 netmask 0xffffff00 broadcast 192.168.177.255
media: Ethernet autoselect (1000baseT <full-duplex>)
status: active
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2
inet 127.0.0.1 netmask 0xff000000
groups: lo
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
backman@bub02:~ $ netstat -rn
Routing tables
Internet:
Destination Gateway Flags Netif Expire
default 192.168.177.1 UGS re0
127.0.0.1 link#2 UH lo0
192.168.177.0/24 link#1 U re0
192.168.177.2 link#1 UHS lo0
Internet6:
Destination Gateway Flags Netif Expire
::/96 ::1 URS lo0
::1 link#2 UHS lo0
::ffff:0.0.0.0/96 ::1 URS lo0
fe80::/10 ::1 URS lo0
fe80::%lo0/64 link#2 U lo0
fe80::1%lo0 link#2 UHS lo0
ff02::/16 ::1 URS lo0
backman@bub02:~ $
Coming over the the ubuntu box, I set it up as a bridge (not done this before probably and error..)
Code:
chris@nas04:~$ ip route show
default via 192.168.178.1 dev enp3s0 proto dhcp src 192.168.178.52 metric 100
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown
192.168.177.0/24 dev br0 proto kernel scope link src 192.168.177.1
192.168.178.0/24 dev enp3s0 proto kernel scope link src 192.168.178.52 metric 100
192.168.178.1 dev enp3s0 proto dhcp scope link src 192.168.178.52 metric 100
chris@nas04:~$ sudo cat /etc/netplan/00-installer-config.yaml
[sudo] password for chris:
# This is the network config written by 'subiquity'
network:
ethernets:
enp3s0:
dhcp4: true
enp4s0:
dhcp4: false
bridges:
br0:
interfaces: [enp4s0]
addresses: [192.168.177.1/24]
version: 2
chris@nas04:~$
For info, my isp router uses lan 192.168.178.0/24, so the laptop is 192.168.178.101, the ubuntu lan nic is 192.168.178.52, and the ubuntu nic facing FBSD is 192.168.177.1, so the FreeBSD box nic is 192.168.177.2.
I can update and upgrade FreeBSD through the ubuntu server fine. I think the problem is where ssh from ubuntu tries to establish 'Remote Protocol Version' from the FreeBSD backup box. Can anyone comment?
I am trying to setup zfs replication from one box to the other. the delay is making the 'zfs receive' fail.
Ok fixed it, kind of. Bit surprised, can't explain it.
when I first set it up, I could get out to update. I must have not made the change boot-surviving. I tried `# pkg udate` but could not get out over the ubuntu box. I had not adding routing, and not modified firewall rules. Added routing=1 and a few firewall rules and the ssh time disappeared. Now ssh instant
Code:
infra@nas04:/home/chris$ sudo sysctl -w net.ipv4.ip_forward=1
net.ipv4.ip_forward = 1
infra@nas04:/home/chris$ sudo iptables -t nat -A POSTROUTING -s 192.168.177.0/24 -o enp3s0 -j MASQUERADE
infra@nas04:/home/chris$ sudo iptables -A FORWARD -i br0 -o enp3s0 -j ACCEPT
infra@nas04:/home/chris$ sudo iptables -A FORWARD -i enp3s0 -o br0 -m state --state RELATED,ESTABLISHED -j ACCEPT
infra@nas04:/home/chris$ sudo sh -c 'iptables-save > /etc/iptables.rules'
infra@nas04:/home/chris$ ssh backman@192.168.177.2
Not sure what is happening here. all ssh expressions use ip addresses. should not need DNS. This little backup extension is all static ip, so no DHCP on bootup. So SSH is using some sort of ip query, but will time-out if no reply?
