I have a windows computer and would like to gain ssh access to powershell from outside my home network. For this purpose, I opened a TCP port on my router and set up automatic forwarding to the computer I want to connect to.

Then, I created a rule in my firewall:

netsh advfirewall firewall add rule name="ps_ssh" dir=in action=allow  protocol=TCP localport=<port_number>

Then I installed and enabled ssh in a powershell admin window:

  Add-WindowsCapability -Online -Name OpenSSH.Server
  Start-Service sshd
  Set-Service -Name sshd -StartupType 'Automatic'

Then I modified my %ProgramData%/ssh/sshd_config file to reflect the following options:

ListenAddress 0.0.0.0
LogLevel DEBUG3
PubkeyAuthentication yes

# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
# but this is overridden so installations will only check .ssh/authorized_keys
# AuthorizedKeysFile .ssh/authorized_keys

Subsystem   sftp    sftp-server.exe
Match Group administrators
       AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys

And then I copied the ~/.ssh/ed25519.pub file from the computer I want to connect with from the outside to a line in C:Users<username>.sshauthorized_keys like

ssh-ed25519 <hash> <user_name>

ending with a newline.

However, when we then try to connect to my home computer from the outside, we get

$ ssh -vvv -i ~/.ssh/id_ed25519 <my_global_ip> -p 22
OpenSSH_8.9p1 Ubuntu-3ubuntu0.4, OpenSSL 3.0.2 15 Mar 2022
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug2: resolve_canonicalize: hostname <my_global_ip> is address
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> '/home/snkr/.ssh/known_hosts'
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> '/home/snkr/.ssh/known_hosts2'
debug3: ssh_connect_direct: entering
debug1: Connecting to <my_global_ip> [<my_global_ip>] port <port_number>.
debug3: set_sock_tos: set socket 3 IP_TOS 0x10
debug1: Connection established.
debug1: identity file /home/snkr/.ssh/id_ed25519 type 3
debug1: identity file /home/snkr/.ssh/id_ed25519-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.4
kex_exchange_identification: read: Connection reset by peer
Connection reset by <my_global_ip> port <port_number>

ssh-keyscan reveals we are not even able to fetch a public key:

$ ssh-keyscan -H <my_global_ip>
89.245.9.216: Connection closed by remote host
89.245.9.216: Connection closed by remote host
89.245.9.216: Connection closed by remote host
89.245.9.216: Connection closed by remote host
89.245.9.216: Connection closed by remote host

Pinging <my_global_ip> works, but telnet also immediately has it’s connection aborted:

$ telnet 89.245.9.216 22
Trying 89.245.9.216...
Connected to 89.245.9.216.
Escape character is '^]'.
Connection closed by foreign host.

And if we look at the OpenSSH logs in the Windows EventViewer, no trace of any connection attempt is logged, only the instances when we ran Restart-Service sshd. This makes me suspect that the Windows firewall is causing problems, but temporarily disabling it also didn’t resolve any of the abovementioned issues.

In this given setup, what exactly are we missing?