RPi for node usage only: I think I goofed it up! Connection error.

[BlackHatCoiner]

So, today, I tried to connect to my Raspberry Pi 4 with ssh via LAN, but it kept loading for several seconds and then returned me this:

ssh: connect to host 192.168.2.7 port 22: Connection timed out

I realized that it must had to do with the firewall that I changed in my linux environment. I just installed ufw and enabled it. Since, then I have never managed to communicate with my machine.

I need your help as I'm not an expert with these things. Is there a way I can disable this possible firewall setting that I changed? Or, can I simply communicate with my RPi again? (without losing the block chain)

[1715459777]

1715459777

[1715459777]

1715459777

[1715459777]

1715459777

[1715459777]

1715459777

[1715459777]

1715459777

[1715459777]

1715459777

[DaveF]

So, today, I tried to connect to my Raspberry Pi 4 with ssh via LAN, but it kept loading for several seconds and then returned me this:

ssh: connect to host 192.168.2.7 port 22: Connection timed out

I realized that it must had to do with the firewall that I changed in my linux environment. I just installed ufw and enabled it. Since, then I have never managed to communicate with my machine.

I need your help as I'm not an expert with these things. Is there a way I can disable this possible firewall setting that I changed? Or, can I simply communicate with my RPi again? (without losing the block chain)

Plug in a USB keyboard & mouse and HDMI monitor and disable the firewall from the unit itself.
Anything you can do through SSH you can do from the console.
If you don't have a GUI installed you may not even need the mouse :-)

If for whatever reason you can't do that, you can pull the SD card and follow the steps here:
https://raspberrypi.stackexchange.com/questions/123964/enabled-firewall-and-rebooted-now-unable-to-ssh

-Dave

[BlackHatCoiner]

If for whatever reason you can't do that, you can pull the SD card and follow the steps here:
https://raspberrypi.stackexchange.com/questions/123964/enabled-firewall-and-rebooted-now-unable-to-ssh

So I followed these steps:

I haven't done the following myself, but I'm fairly confident this will work (it won't hurt)

• take the SD card out and put it in another computer
  
• edit cmdline.txt (careful which editor you use)
• add init=/boot/fixufw.sh to the end of the line
• create fixufw.sh file in the boot partition,

Code:

#!/bin/sh
ufw disable
shutdown

or even

Code:

#!/bin/sh
ufw limit from any to any app SSH
shutdown

• put the SD card into the pi and boot
• wait a few moments until the pi has booted and shut down
• edit the SD card to remove the text you added
• put the card in the pi and boot

What's the problem: The Pi never shuts down. Based on this answer, I should wait for it to start, disable the ufw and then shutdown. Instead, it remains open. I've tried both scripts by the way.

And I'm afraid that's the only answer for my problem. Google returned this and some other non-related.

If for whatever reason you can't do that

Yep. Can't do this.

[n0nce]

I would actually just connect a monitor and keyboard as Dave first suggested.

To clarify the issue you're having:
You installed a firewall which by default blocks everything, including closing the SSH port.
Since you exited the SSH session before adding a rule that allows to connect to port 22, you can't get back in via SSH.

The only 2 options are

• Log in locally (keyboard & monitor) and disable the firewall entirely (to add the SSH rule later) or add the SSH rule right away
  
• Write some commands to perform the aforementioned tasks for you upon boot in some specific files as explained in the quoted text.
  

In my experience, option 2 may sometimes not work, since the location changes, you messed up the file type of the script, a command has a typo etc etc and it's super hard to debug if you don't see why something failed. So I prefer option 1.

Are you sure fixufw.sh and cmdline.txt are in the right partition, right folder?

[BlackHatCoiner]

Are you sure fixufw.sh and cmdline.txt are in the right partition, right folder?

I think so.

I've created fixufw.sh in E:\ (where cmdline.txt is)

This is my cmdline.txt:

Code:

console=serial0,115200 console=tty1 root=PARTUUID=c5a1bb60-02 rootfstype=ext4 elevator=deadline fsck.repair=yes rootwait
usb-storage.quirks=0bc2:ab26:u 
init=/boot/fixufw.sh

I've also tried this one:

Code:

console=serial0,115200 console=tty1 root=PARTUUID=c5a1bb60-02 rootfstype=ext4 elevator=deadline fsck.repair=yes rootwait
usb-storage.quirks=0bc2:ab26:u init=/boot/fixufw.sh

So I prefer option 1.

I also prefer option 1, but I don't have a monitor with HDMI that I can plug it at the moment.

[NotATether]

Is it possible to hard-reset the RPi and boot it into rescue mode (by pressing and holding SHIFT while it's booting) where the firewall won't be enabled?

Or can you try booting it using PXE (network) boot (it needs to be connected to a network where there is a host it can pull boot images from)?

[BlackHatCoiner]

It's not good advice, but i would modify the crontab file (/var/spool/cron/crontabs/root) directly if other advice doesn't work.

Code:

@reboot ufw disable

There's no root file in crontabs. Should I create it?

[n0nce]

I've also tried this one:

Code:

console=serial0,115200 console=tty1 root=PARTUUID=c5a1bb60-02 rootfstype=ext4 elevator=deadline fsck.repair=yes rootwait
usb-storage.quirks=0bc2:ab26:u init=/boot/fixufw.sh

It definitely needs to be in a new line like this though.

Code:

console=serial0,115200 console=tty1 root=PARTUUID=c5a1bb60-02 rootfstype=ext4 elevator=deadline fsck.repair=yes rootwait
usb-storage.quirks=0bc2:ab26:u
init=/boot/fixufw.sh

It's not good advice, but i would modify the crontab file (/var/spool/cron/crontabs/root) directly if other advice doesn't work.

Code:

@reboot ufw disable

There's no root file in crontabs. Should I create it?

Yes you can create it; whatever's in it will be executed as root when rebooting.

[BlackHatCoiner]

I created the root file, added the text above, clicked save, switched on my RPi... Nothing. I still can't connect via ssh.

[vv181]

As @OP using Windows, does it has something to do with file permission when the cron file is created or the text editor end of line things(CR-LF things) for the @DaveF suggestion?

[BlackHatCoiner]

As @OP using Windows, does it has something to do with file permission when the cron file is created or the text editor end of line things(CR-LF things) for the @DaveF suggestion?

I did this from Ubuntu. Not Windows.

[vv181]

I did this from Ubuntu. Not Windows.

Oh, I thought you are using Win since I see the screenshot you posted above.

Anyway, try to manually disable UFW on boot.

Edit the ufw config file on /etc/ufw/ufw.conf

Code:

# /etc/ufw/ufw.conf
#

# Set to yes to start on boot. If setting this remotely, be sure to add a $
# to allow your remote connection before starting ufw. Eg: 'ufw allow 22/t$
ENABLED=yes

# Please use the 'ufw' command to set the loglevel. Eg: 'ufw logging mediu$
# See 'man ufw' for details.
LOGLEVEL=low

Your file probably should look like that, then change the ENABLED line to no.

Code:

ENABLED=no

After that, try to boot the pi up again. If it still doesn't work, I suspect that it's either my way not working or you messed up the cmdline.txt file, which makes your pi not booting up, though, I'm not sure about the second option.

Thanks, vv181! It worked!

Aight, glad it helped.

[BlackHatCoiner]

Thanks, vv181! It worked!

[n0nce]

I created the root file, added the text above, clicked save, switched on my RPi... Nothing. I still can't connect via ssh.

I know @vv181 already give working solution, but the reason my solution isn't working might be because you didn't change ownership/mode. It should be look like this.

Code:

-rw------- 1 root crontab 1.2K Oct 01 02:31 root

Anyway, the file supposed to be created through command sudo crontab -e, so you might want to delete the root file you created manually.

I'm still wondering why the cmdline.txt method didn't work.
And yes, BlackHatCoiner, make sure to undo / delete all the stuff you changed to make sure your system is 'clean' again
It's easy to forget

[DaveF]

I also prefer option 1, but I don't have a monitor with HDMI that I can plug it at the moment.

Glad you got it working.

On a side note, they are microHDMI to VGA or DVI or DisplyPort cables.
If you are going to be working a lot with RPi 4 units, it's probably worth getting one (or more then one)
That or a microHDMI to full size one and go from there. For cable management they even make right and left angle ones.

Think about how much time you spent on this vs, grabbing a cable, plugging it in and done.

-Dave