Port is closed on Azure Linux VM even though allowed by network security group (NSG)

Question

here's my scenario:

I have IP camera behind the company firewall that I want to stream publicly, and for that, I've created two Azure VMs (Ubuntu 19.04) - let's call them vm1 and vm2

In case it's important, my VM SKU is Standard B1s (1 vcpus, 1 GiB memory)

1. I SSH to my camera and from there, I do a remote port forwarding for RTSP like this:

   ssh -R 554:localhost:554 root@<vm1-ip>
   

   And, I guess I need to enable root SSH because it's a "well-known" port.

2. I log in to vm1, and I see it's listening on the port: sudo netstat -tlnp gives me this:

   Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
   tcp        0      0 127.0.0.1:554           0.0.0.0:*               LISTEN      108748/sshd: root@p
   tcp6       0      0 ::1:554                 :::*                    LISTEN      108748/sshd: root@p
   

3. But, when I use nmap from from vm2, the port is shown as closed:

   nmap <vm1-ip> -p 554
   
   PORT    STATE  SERVICE
   554/tcp closed rtsp
   

4. When I use vlc to connect to the stream, it doesn't work either: the URL I use in vlc is: rtsp://<vm1-ip>/...

5. I thought this might be an issue with the NSG (network security group) associated with vm1, so I tried allowing all inbound traffic: and, needless to say that it doesn't solve the issue

Any thoughts on this?

Thank you

Answer 1

I had the same issue and solved it with enabling the GatewayPorts option on the SSH server configuration file on the Azure VM. This option allows remote hosts to connect to local forwarded ports. By default, it is set to no, which means that only connections from the loopback address (127.0.0.1) are allowed.

To enable the GatewayPorts option, you need to do the following steps:

• Log in to the Azure VM as root or a user with sudo privileges.
• Edit the /etc/ssh/sshd_config file with your preferred text editor, such as nano or vi.
• Find the line that says #GatewayPorts no and uncomment it by removing the # symbol. Then change the value from no to yes or clientspecified. The yes value means that the SSH server will bind the local port to any address, while the clientspecified value means that the SSH client will specify the address to bind to. For example, you can use -R 554:0.0.0.0:554 to bind to any address, or -R 554:127.0.0.1:554 or -R 554:localhost:554 to bind to a specific address.
• Save and close the file.
• Restart the SSH service with the command sudo systemctl restart sshd or sudo service sshd restart, depending on your Linux distribution.