SSH daemon listens on both IPv4 and IPv6, but I can connect only over v6 Ok, maybe I'm weird or something, but I can't figure this one out. MacOS Mojave, native IPv6 from my ISP.

As you can see, sshd is listening on both v4 and v6:

alluminium:~ root# netstat -an | grep 22 | grep LISTEN
tcp4       0      0  *.22                   *.*                    LISTEN
tcp6       0      0  *.22                   *.*                    LISTEN


Local connection on non-loopback interface over v4 works perfectly: 

alluminium:~ root# nc -w1 -z -v 192.168.2.12 22
found 0 associations
found 1 connections:
     1: flags=82&lt;CONNECTED,PREFERRED&gt;
    outif lo0
    src 192.168.2.12 port 59078
    dst 192.168.2.12 port 22
    rank info not available
    TCP aux info available

Connection to 192.168.2.12 port 22 [tcp/ssh] succeeded!


Now, when I try remote, on v6 it works:

root@keeper:~# ssh alluminium -v
OpenSSH_7.4p1, OpenSSL 1.0.2r-fips  26 Feb 2019
debug1: Connecting to alluminium [2001:985:4xxxxxxx:d585] port 22.
debug1: Connection established.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'alluminium,2001:985:4xxxxxx:d585' (ECDSA) to the list of known hosts.

debug1: Next authentication method: keyboard-interactive
Password:


However, v4 just times out:

root@keeper:~# ssh 192.168.2.12 -v
OpenSSH_7.4p1, OpenSSL 1.0.2r-fips  26 Feb 2019
debug1: Connecting to 192.168.2.12 [192.168.2.12] port 22.


I have checkpoint endpoint security installed, thought it might get in the way, shut down all its components, PF rules don't show anything either.. Nothing. 

I feel totally stupid now :) Any suggestions are much appreciated.
Right.. I finally figured it out.

It still was the damned Checkpoint Endpoint Security VPN client. Apparently it installs a kernel extension com.checkpoint.cpfw that the service com.checkpoint.epc.service controls according to organizational policy. In my case it was dropping all incoming connections. Shutting down service doesn't flush the rules enforced by the kernel extension. 

Unloading the kernel extension helped.