The problem
The ssh: connect to host bitbucket.org port 22: Network is unreachable error is indicative of network traffic on port 22 being blocked. Since it's not being blocked by my Windows firewall, since I turned it off to test, then external traffic on port 22 must be getting blocked by the network admins of the remote network that my remote machine is on.
That's frustrating.
The fix: route SSH traffic to Bitbucket.org through port 443 instead
...if your network admins are blocking external traffic on port 22
Tested on Windows 10 Pro in the Git Bash terminal which comes with Git For Windows.
Late last night I Googled "bitbucket use port other than 22", and came across this really helpful answer: Super User: Which port must I ask to open to clone a git repository from bitbucket?.
By simply creating a ~/.ssh/config file which contains this:
Host bitbucket.org
HostName altssh.bitbucket.org
Port 443
HostkeyAlias bitbucket.org
...my SSH clone requests to BitBucket.org are now routed through port 443, which is open, instead of port 22, which is blocked on that network, and I can now run git clone git@bitbucket.org:my_workspace/my_repo.git and it works perfectly! It takes a little longer than normal, and at once point asked if I was sure I wanted to connect, but it works!
Big kudos to @u1686_grawity for sharing this excellent work-around.
This morning, @Jim Redmond pointed it out too.
Note that the only reason this works is because BitBucket.org has graciously decided to accept SSH connections on port 443 as well, probably to help poor folks like me on networks blocking port 22 traffic.
How to check if your network is blocking your port 22 traffic
I did a lot of research and figured out some ways to help people identify if their network firewall is the problem.
If you're on Linux Ubuntu, install nmap ("network map") and ncat (a modern reimplementation of netcat, or nc) like this:
sudo snap install nmap
sudo apt update && sudo apt install ncat
If you're on Windows, download the nmap binary installer, here: https://nmap.org/download.html. The latest version at this moment is nmap-7.94-setup.exe. This installer also includes the pcap (packet capture) tool, as well as the ncat netcat replacement tool.
Once you are armed with these tools: nmap, ncat, and a browser, you can begin your tests.
Typically:
- Port 80 is for HTTP browser traffic.
- Port 443 is for HTTPS browser traffic.
- Port 22 is for SSH traffic.
So, open a browser and navigate to https://bitbucket.org/. If that opens, then port 443 is open.
Next, let's nmap it:
In Windows, be sure to run this as an administrator. I recommend right-clicking Git Bash, which comes with Git For Windows, and going to "Run as administrator". Then run this command. It is the same on both Linux and Windows:
# map the ports on bitbucket.org to see which are open
nmap bitbucket.org
On a local Linux Ubuntu 22.04 system on an open/home fiber-optic network, I get the following. Notice that ports 22, 80, and 443 are all open:
$ nmap bitbucket.org
Starting Nmap 7.93 ( https://nmap.org ) at 2023-08-17 14:34 MST
Nmap scan report for bitbucket.org (18.205.93.0)
Host is up (0.071s latency).
Other addresses for bitbucket.org (not scanned): 18.205.93.1 18.205.93.2 2406:da00:ff00::22cd:e0db
Not shown: 997 filtered tcp ports (no-response)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
443/tcp open https
Nmap done: 1 IP address (1 host up) scanned in 6.02 seconds
On my local, working Windows 10 Pro machine which is VPNed in to a remote network, I get this (reminder: run this in a terminal as an administrator). All 3 ports are all open:
$ nmap bitbucket.org
Starting Nmap 7.94 ( https://nmap.org ) at 2023-08-17 14:36 US Mountain Standard Time
Nmap scan report for bitbucket.org (104.192.141.1)
Host is up (0.035s latency).
Not shown: 997 filtered tcp ports (no-response)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
443/tcp open https
Nmap done: 1 IP address (1 host up) scanned in 5.56 seconds
On my remote, previously-non-working Windows 10 Pro machine, I get this. Notice here that port 22 is not open! I can safely assume the managed network over there is blocking external traffic over port 22. Notice also how much slower this one is. My other two systems took ~6 seconds, but this one takes 34 seconds:
$ nmap bitbucket.org
Starting Nmap 7.94 ( https://nmap.org ) at 2023-08-17 14:36 Pacific Daylight Time
Nmap scan report for bitbucket.org (104.192.141.1)
Host is up (0.0040s latency).
Not shown: 998 filtered tcp ports (no-response)
PORT STATE SERVICE
80/tcp open http
443/tcp open https
Nmap done: 1 IP address (1 host up) scanned in 34.45 seconds
To verify the results above, we can use ncat manually:
time ncat -zv bitbucket.org 22 # manually check port 22
time ncat -zv bitbucket.org 80 # manually check port 80
time ncat -zv bitbucket.org 443 # manually check port 443
Here are my results on the machine which has port 22 blocked. Again, notice that for ports 80 and 443 to bitbucket.org I get "Connected to...", but for port 22 I just get "TIMEOUT":
$ time ncat -zv bitbucket.org 22
Ncat: Version 7.94 ( https://nmap.org/ncat )
Ncat: TIMEOUT.
real 0m10.245s
user 0m0.000s
sys 0m0.046s
$ time ncat -zv bitbucket.org 80
Ncat: Version 7.94 ( https://nmap.org/ncat )
Ncat: Connected to 104.192.141.1:80.
Ncat: 0 bytes sent, 0 bytes received in 0.20 seconds.
real 0m0.256s
user 0m0.000s
sys 0m0.015s
$ time ncat -zv bitbucket.org 443
Ncat: Version 7.94 ( https://nmap.org/ncat )
Ncat: Connected to 104.192.141.1:443.
Ncat: 0 bytes sent, 0 bytes received in 0.18 seconds.
real 0m0.226s
user 0m0.000s
sys 0m0.015s
You should also try:
nmap github.com to check and ensure the problem isn't just bitbucket.org. When I run nmap github.com on a good machine, again, I see that ports 22, 80, and 443 are open. But, on my blocked machine, again, only ports 80 and 443 are open.- Running Wireshark to watch traffic and see how and whether or not the forwarding mechanism in
~/.ssh/config alters the SSH traffic.
References
- Where I found the solution: Super User: Which port must I ask to open to clone a git repository from bitbucket?
- Where I learned how to use
nc -zv bitbucket.org 22 (on the original netcat, nc), or ncat -zv bitbucket.org 22 (on the ncat that comes with nmap): Super User: Ping Equivalent for SSH
- Download
nmap: https://nmap.org/download.html
- Lots of trial and error.
See also
Now that I know to google "Host bitbucket.org
HostName altssh.bitbucket.org
Port 443
HostkeyAlias bitbucket.org", I just discovered this answer after-the-fact, too: ssh: connect to host bitbucket.org port 22: Connection timed out.
Bitbucket/Atlassian's official documentation on the topic (thanks, @Jim Redmond!):
Atlassian Support / Bitbucket Cloud Knowledge Base / Troubleshooting SSH issues: Port 22 is blocked on local network:
Summary
Some network administrators block outgoing SSH connections on port 22. If your network blocks this port, Bitbucket provides an alternate hostname and port combination you can use.
This article describes how to use the alternate ssh host: altssh.bitbucket.org:443.
.
.
.
Cause
A firewall rule is blocking outgoing connections over port 22.
Solution
Instead of using the normal ssh port, use altssh.bitbucket.org over port 443. Typically, port 443 is used for HTTPS, so administrators leave this port open for outbound web browsing. In this case, here's the URLs you can use:
ssh://git@altssh.bitbucket.org:443/<Workspace>/<repo_name>/
Here is a normal clone command and alternate command as an example:
git clone git@bitbucket.org:<Workspace>/<repo_name>/ # Original
git clone ssh://git@altssh.bitbucket.org:443/<Workspace>/<repo_name>/ # Alternate
https://bitbucket.org/blog/author/jredmond
