SSH Connectivity to RDHPCS (Gaea/Ursa) — Diagnosis from Cloud Hosts

Date: August 5, 2026
Platform tested from: Parallel Works (AWS, us-east-1, 10.7.x.x subnet)
Targets: gaea-rsa.princeton.rdhpcs.noaa.gov, ursa-rsa.princeton.rdhpcs.noaa.gov

---

Summary

SSH connections to Gaea and Ursa fail with "Network is unreachable" when initiated from cloud-based hosts (e.g., Parallel Works). This is expected behavior — the RDHPCS bastion hosts only accept SSH from pre-approved (whitelisted) source IP addresses.

---

How We Diagnosed This (Step by Step)

Step 1 — Attempt the SSH connection

ssh -o ConnectTimeout=10 -o BatchMode=yes Gaea echo "connected"

Result: ssh: connect to host gaea-rsa.princeton.rdhpcs.noaa.gov port 22: Network is unreachable

This tells us the TCP connection cannot be established at all. The same result occurred for Ursa.

What this means for a beginner: The computer tried to open a network connection to the remote server, but the connection was blocked before it even reached the server. It's like trying to call a phone number that your phone company has blocked — you don't even get a ring.

---

Step 2 — Verify DNS resolution

host gaea-rsa.princeton.rdhpcs.noaa.gov

Result: gaea-rsa.princeton.rdhpcs.noaa.gov has address 140.208.152.3

What this means: The hostname resolves to a valid IP address. DNS is not the problem. Think of DNS like a phone book — we can look up the number, so the address is correct.

---

Step 3 — Verify general internet connectivity

curl -s --max-time 5 -o /dev/null -w "%{http_code}" https://www.google.com

Result: 200 (success)

What this means: Our host can reach the public internet just fine. The problem is specific to the RDHPCS network, not a general networking failure.

---

Step 4 — Check if a route exists to the destination

ip route get 140.208.152.3

Result: 140.208.152.3 via 10.7.0.1 dev eth0 src 10.7.11.227

What this means: The operating system knows how to send packets toward that IP (via the default gateway). Routing is configured correctly on our end.

---

Step 5 — Trace the network path

traceroute -m 5 -w 2 140.208.152.3

Result: Packets leave AWS, traverse the Level3 backbone in Washington DC, but never reach the NOAA/Princeton network.

What this means: Our packets travel across the internet but are dropped or filtered before reaching the RDHPCS bastion. This is the firewall in action.

---

Step 6 — Test TCP port 22 directly

nc -z -w 5 140.208.152.3 22

Result: Exit code 1 (connection failed/filtered)

What this means: Even a raw TCP connection attempt to port 22 (SSH) is blocked. The RDHPCS firewall is rejecting connections from our source IP.

---

Conclusion

Check	Result	Meaning
DNS resolution	✅ Working	Hostnames are valid
Internet access	✅ Working	Host has general connectivity
Route to target	✅ Exists	OS knows where to send packets
Traceroute	⚠️ Drops at edge	Packets reach the backbone but not RDHPCS
TCP port 22	❌ Filtered	Firewall is blocking our IP

Root cause: The RDHPCS bastion hosts (*.princeton.rdhpcs.noaa.gov) enforce an IP-based access control list (ACL). Only pre-approved source IPs are allowed to connect on port 22. The Parallel Works host's public IP (the AWS NAT gateway) is not on that list.

---

Key Concepts for Beginners

Term	Plain-English Explanation
SSH	Secure Shell — a way to log into a remote computer over the network
Port 22	The standard "door number" that SSH servers listen on
Firewall / ACL	A security gate that only lets approved visitors through
DNS	Translates human-readable names (like gaea-rsa...) into IP addresses
Traceroute	Shows the path packets take across the internet, hop by hop
NAT gateway	The shared public IP that all traffic from a private network appears to come from
ProxyJump	An SSH feature that bounces your connection through an intermediate server
RDHPCS	Research and Development High Performance Computing System (NOAA's HPC infrastructure)
Bastion host	A hardened gateway server that guards access to an internal network