This might be a stupid question, but I'm wondering how a network blocks a protocol like SSH even if the server is listening on port that isn't blocked, like 80. I've even tried port forwarding an non-blocked port to port 22 on the server side and I still get blocked. (This only affects external connections, SSH works just fine on local connections.)

I'm curious how exactly something like this is accomplished. This is definitely my weak area, so again sorry if it's a dumb question.


  • 2
    Deep Packet Inspection. Ask the network admin that set it up. – Ricky Nov 22 '17 at 22:30
  • How do you know port 80 isn't blocked? Does it work with an HTTP server? Firewalls block all incoming traffic by default. Also, things like CGN will prevent this from working. – Ron Maupin Nov 22 '17 at 23:15

Traditionally services were identified by the listening port on the server end and then controlled by manipulating access to that port. You would then be able to circumvent that control by doing what you attempt to be doing, have the blocked service listen on a different port and hopefully go around the block.

Modern networks have the ability to not only look at the destination port but analyze the bitstream to match and identify patterns that are inherent to different protocols. This is often called "Deep Packet Inspection" or "Protocol Analysis".


Modern firewalls do not only check IP and TCP layer but also go a layer higher. It will check the contents of the TCP package.

It will check for patterns that always hold for a specific protocol.

In the case of SSH, the pattern is:

  • The first 4 bytes contain the length of the package.
  • Everything else is encrypted using a algorithm that results in a output where every byte is just as likely to occur.

So if the firewall sees packages with as contents 4 bytes that when transformed to a number are always equal to the length of the data and after those 4 bytes all data looks random then it can be pretty much sure that it's ssh traffic and block it.


There might be security settings on the server that allow or denies traffic destined to daemons. So telnet over a certain port might work because the server listen on that port - but sshd might deny the source address. Verify this by checking the following files on your server:


For more information, see hosts_access(5).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.