openssh - SSH Connection to ubuntu works on the internal network, but not from outside - Ask Ubuntu

the other similar questions on ask ubuntu have not helped me resolve issue.

i have ubuntu server can ssh onto no problems when on computer on local network, when try outside get

permission denied (publickey) 

i've created new key pair , added public key authorized_keys.

i've made sure authorized keys has correct permissions set (0600)

the port forwarding on router seems setup correctly can see attempts connect in /var/log/auth.log

oct 26 16:37:59 ubuntu sshd[1804]: connection closed xx.xx.xx.xx [preauth] 

this -vvv option

openssh_6.6.1, openssl 1.0.1f 6 jan 2014 debug1: reading configuration data /home/mike/.ssh/config debug1: /home/mike/.ssh/config line 19: applying options * debug1: /home/mike/.ssh/config line 145: applying options beansprout.1 debug1: reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 19: applying options * debug1: hostname has changed; re-reading configuration debug1: reading configuration data /home/mike/.ssh/config debug1: /home/mike/.ssh/config line 19: applying options * debug1: reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 19: applying options * debug2: ssh_connect: needpriv 0 debug1: connecting xx.xx.xx.xx [xx.xx.xx.xx] port 22. debug1: connection established. debug3: incorrect rsa1 identifier debug3: not load "/home/mike/.ssh/beansprout_live" rsa1 public key debug1: identity file /home/mike/.ssh/beansprout_live type 1 debug1: identity file /home/mike/.ssh/beansprout_live-cert type -1 debug1: enabling compatibility mode protocol 2.0 debug1: local version string ssh-2.0-openssh_6.6.1p1 ubuntu-2ubuntu2.8 debug1: remote protocol version 2.0, remote software version openssh_6.6.1p1 ubuntu-2ubuntu2.8 debug1: match: openssh_6.6.1p1 ubuntu-2ubuntu2.8 pat openssh_6.6.1* compat 0x04000000 debug2: fd 3 setting o_nonblock debug3: load_hostkeys: loading entries host "xx.xx.xx.xx" file "/home/mike/.ssh/known_hosts" debug3: load_hostkeys: found key type ecdsa in file /home/mike/.ssh/known_hosts:24 debug3: load_hostkeys: loaded 1 keys debug3: order_hostkeyalgs: prefer hostkeyalgs: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521 debug1: ssh2_msg_kexinit sent debug1: ssh2_msg_kexinit received debug2: kex_parse_kexinit: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 debug2: kex_parse_kexinit: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-dss-cert-v00@openssh.com,ssh-ed25519,ssh-rsa,ssh-dss debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se debug2: kex_parse_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib debug2: kex_parse_kexinit:  debug2: kex_parse_kexinit:  debug2: kex_parse_kexinit: first_kex_follows 0  debug2: kex_parse_kexinit: reserved 0  debug2: kex_parse_kexinit: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 debug2: kex_parse_kexinit: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ssh-ed25519 debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se debug2: kex_parse_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: none,zlib@openssh.com debug2: kex_parse_kexinit: none,zlib@openssh.com debug2: kex_parse_kexinit:  debug2: kex_parse_kexinit:  debug2: kex_parse_kexinit: first_kex_follows 0  debug2: kex_parse_kexinit: reserved 0  debug2: mac_setup: setup hmac-md5-etm@openssh.com debug1: kex: server->client aes128-ctr hmac-md5-etm@openssh.com none debug2: mac_setup: setup hmac-md5-etm@openssh.com debug1: kex: client->server aes128-ctr hmac-md5-etm@openssh.com none debug1: sending ssh2_msg_kex_ecdh_init debug1: expecting ssh2_msg_kex_ecdh_reply debug1: server host key: ecdsa xxxxxxxxxxxxxxxxxxxxxxxxx debug3: load_hostkeys: loading entries host "xx.xx.xx.xx" file "/home/mike/.ssh/known_hosts" debug3: load_hostkeys: found key type ecdsa in file /home/mike/.ssh/known_hosts:24 debug3: load_hostkeys: loaded 1 keys debug1: host 'xx.xx.xx.xx' known , matches ecdsa host key. debug1: found key in /home/mike/.ssh/known_hosts:24 debug1: ssh_ecdsa_verify: signature correct debug2: kex_derive_keys debug2: set_newkeys: mode 1 debug1: ssh2_msg_newkeys sent debug1: expecting ssh2_msg_newkeys debug2: set_newkeys: mode 0 debug1: ssh2_msg_newkeys received debug1: ssh2_msg_service_request sent debug2: service_accept: ssh-userauth debug1: ssh2_msg_service_accept received debug2: key: /home/mike/.ssh/beansprout_live (0x555f8eacc7c0), explicit debug1: authentications can continue: publickey debug3: start over, passed different list publickey debug3: preferred publickey debug3: authmethod_lookup publickey debug3: remaining preferred:  debug3: authmethod_is_enabled publickey debug1: next authentication method: publickey debug1: offering rsa public key: /home/mike/.ssh/beansprout_live debug3: send_pubkey_test debug2: sent publickey packet, wait reply debug1: authentications can continue: publickey debug2: did not send packet, disable method debug1: no more authentication methods try. permission denied (publickey) 

i ran tcpdump, got when tried ssh in

frank@ubuntu:~/.ssh$ sudo tcpdump -i src host xx.xx.xx.xx -vvv tcpdump: listening on any, link-type linux_sll (linux cooked), capture size 65535 bytes 16:45:31.390406 ip (tos 0x4, ttl 58, id 5782, offset 0, flags [df], proto tcp (6), length 60)     s0106bc4dfb2cb3c3.vc.shawcable.net.33168 > 192.168.1.100.ssh: flags [s], cksum 0x2529 (correct), seq 1124079693, win 29200, options [mss 1460,sackok,ts val 5246683 ecr 0,nop,wscale 7], length 0 16:45:31.438365 ip (tos 0x4, ttl 58, id 5783, offset 0, flags [df], proto tcp (6), length 52)     s0106bc4dfb2cb3c3.vc.shawcable.net.33168 > 192.168.1.100.ssh: flags [.], cksum 0xef7b (correct), seq 1124079694, ack 2925922470, win 229, options [nop,nop,ts val 5246693 ecr 138876], length 0 16:45:31.438403 ip (tos 0x4, ttl 58, id 5784, offset 0, flags [df], proto tcp (6), length 95)     s0106bc4dfb2cb3c3.vc.shawcable.net.33168 > 192.168.1.100.ssh: flags [p.], cksum 0x91f4 (correct), seq 0:43, ack 1, win 229, options [nop,nop,ts val 5246693 ecr 138876], length 43 16:45:31.500729 ip (tos 0x4, ttl 58, id 5785, offset 0, flags [df], proto tcp (6), length 52)     s0106bc4dfb2cb3c3.vc.shawcable.net.33168 > 192.168.1.100.ssh: flags [.], cksum 0xef08 (correct), seq 43, ack 44, win 229, options [nop,nop,ts val 5246708 ecr 138890], length 0 16:45:31.501685 ip (tos 0x4, ttl 58, id 5786, offset 0, flags [df], proto tcp (6), length 1500)     s0106bc4dfb2cb3c3.vc.shawcable.net.33168 > 192.168.1.100.ssh: flags [.], cksum 0xcc1c (correct), seq 43:1491, ack 44, win 229, options [nop,nop,ts val 5246708 ecr 138890], length 1448 16:45:31.502110 ip (tos 0x4, ttl 58, id 5787, offset 0, flags [df], proto tcp (6), length 572)     s0106bc4dfb2cb3c3.vc.shawcable.net.33168 > 192.168.1.100.ssh: flags [p.], cksum 0x6aec (correct), seq 1491:2011, ack 44, win 229, options [nop,nop,ts val 5246708 ecr 138890], length 520 16:45:31.530287 ip (tos 0x4, ttl 58, id 5788, offset 0, flags [df], proto tcp (6), length 52)     s0106bc4dfb2cb3c3.vc.shawcable.net.33168 > 192.168.1.100.ssh: flags [.], cksum 0xe18e (correct), seq 2011, ack 1492, win 251, options [nop,nop,ts val 5246719 ecr 138891], length 0 16:45:31.530301 ip (tos 0x4, ttl 58, id 5789, offset 0, flags [df], proto tcp (6), length 52)     s0106bc4dfb2cb3c3.vc.shawcable.net.33168 > 192.168.1.100.ssh: flags [.], cksum 0xe0a3 (correct), seq 2011, ack 1692, win 274, options [nop,nop,ts val 5246719 ecr 138903], length 0 16:45:31.540611 ip (tos 0x4, ttl 58, id 5790, offset 0, flags [df], proto tcp (6), length 100)     s0106bc4dfb2cb3c3.vc.shawcable.net.33168 > 192.168.1.100.ssh: flags [p.], cksum 0xb828 (correct), seq 2011:2059, ack 1692, win 274, options [nop,nop,ts val 5246721 ecr 138904], length 48 16:45:31.581987 ip (tos 0x4, ttl 58, id 5791, offset 0, flags [df], proto tcp (6), length 68)     s0106bc4dfb2cb3c3.vc.shawcable.net.33168 > 192.168.1.100.ssh: flags [p.], cksum 0xd4f3 (correct), seq 2059:2075, ack 1972, win 296, options [nop,nop,ts val 5246732 ecr 138915], length 16 16:45:31.656372 ip (tos 0x4, ttl 58, id 5792, offset 0, flags [df], proto tcp (6), length 104)     s0106bc4dfb2cb3c3.vc.shawcable.net.33168 > 192.168.1.100.ssh: flags [p.], cksum 0x0736 (correct), seq 2075:2127, ack 1972, win 296, options [nop,nop,ts val 5246750 ecr 138936], length 52 16:45:31.688538 ip (tos 0x4, ttl 58, id 5793, offset 0, flags [df], proto tcp (6), length 120)     s0106bc4dfb2cb3c3.vc.shawcable.net.33168 > 192.168.1.100.ssh: flags [p.], cksum 0xb402 (correct), seq 2127:2195, ack 2024, win 296, options [nop,nop,ts val 5246758 ecr 138942], length 68 16:45:31.764659 ip (tos 0x4, ttl 58, id 5794, offset 0, flags [df], proto tcp (6), length 424)     s0106bc4dfb2cb3c3.vc.shawcable.net.33168 > 192.168.1.100.ssh: flags [p.], cksum 0x5f1e (correct), seq 2195:2567, ack 2076, win 296, options [nop,nop,ts val 5246777 ecr 138962], length 372 16:45:31.800705 ip (tos 0x4, ttl 58, id 5795, offset 0, flags [df], proto tcp (6), length 52)     s0106bc4dfb2cb3c3.vc.shawcable.net.33168 > 192.168.1.100.ssh: flags [f.], cksum 0xdc27 (correct), seq 2567, ack 2128, win 296, options [nop,nop,ts val 5246785 ecr 138970], length 0 16:45:31.858424 ip (tos 0x4, ttl 58, id 5796, offset 0, flags [df], proto tcp (6), length 52)     s0106bc4dfb2cb3c3.vc.shawcable.net.33168 > 192.168.1.100.ssh: flags [.], cksum 0xdc09 (correct), seq 2568, ack 2129, win 296, options [nop,nop,ts val 5246800 ecr 138984], length 0 

where else try , figure out setup wrong?

thanks

edit:

ssh config settings

host *     identitiesonly yes     sendenv lang lc_*     hashknownhosts yes     gssapiauthentication yes     gssapidelegatecredentials no  host beansprout.1     hostname xx.xx.xx.xx     user frank     identityfile ~/.ssh/beansprout_live