LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 01-01-2004, 05:18 PM   #1
clau_bolson
Member
 
Registered: Nov 2003
Location: Argentina
Distribution: Debian Sarge
Posts: 52

Rep: Reputation: 15
Conneting to a computer thru a firewall


Hi, I think this is extremely simple but I'm stuck.
I have a direct connection to the internet and a private network.
I have to enter one of the computers in the private network from the internet.
This computer is a linux box with openssh listening in port 22. (ip 192.168.5.2)

So I have another box with two network boards, one connected to the internet (ip xx.xx.xx.xx) and another conected to my internal network (192.168.5.37)
in this box every port is closed as read with netstat.

So far I've wrote:
iptables -t nat -A PREROUTING -p tcp -d xx.xx.xx.xx --dport 22 -j DNAT --to 192.168.5.2:22
iptables -A FORWARD -p tcp -d 192.168.5.2 --dport 22 -j ACCEPT

but nothing happens, (I am trying to enter from my Windows box using Putty, using xx.xx.xx.xx port 22 as the IP)

Please help me, I'm here working on Jan 1 because this has to be ready for tomorrow.
Thanks and happy 2004 for you all.
 
Old 01-01-2004, 05:29 PM   #2
g-rod
Member
 
Registered: Dec 2003
Location: Long Island, NY USA
Distribution: RedHat, SUSE
Posts: 336

Rep: Reputation: 30
Are you NATing (MASQUERADING) the outbound(postrouting)?
 
Old 01-01-2004, 05:31 PM   #3
Mara
Moderator
 
Registered: Feb 2002
Location: Grenoble
Distribution: Debian
Posts: 9,539

Rep: Reputation: 149Reputation: 149
I'm not sure if you need :22 with --to when the port is gived by --dport. Here's part of my firewall (port 5555 is freeciv, btw)
I think that EXTIF and EXTIP are easy to understand.
Code:
 
$IPTABLES -A FORWARD -i $EXTIF -p tcp -d 192.168.1.3 --dport 5555 -j ACCEPT

 $IPTABLES -A PREROUTING -t nat -i $EXTIF -p tcp -d $EXTIP --dport 5555 -j DNAT 
--to 192.168.1.3
Edit: I also agree that -t nat is not needed.

Last edited by Mara; 01-01-2004 at 05:33 PM.
 
Old 01-01-2004, 05:48 PM   #4
clau_bolson
Member
 
Registered: Nov 2003
Location: Argentina
Distribution: Debian Sarge
Posts: 52

Original Poster
Rep: Reputation: 15
Thanks for your quick answers
g-rod: no, this is a box I set up just for this purpose. Should I?
Mara: I rewrote the iptables commands just as yours but nothing happens.
iptables -t nat -L -v shows that there are packages entering through that chain.
In theory there is nothing more to do, is there?
 
Old 01-01-2004, 06:00 PM   #5
g-rod
Member
 
Registered: Dec 2003
Location: Long Island, NY USA
Distribution: RedHat, SUSE
Posts: 336

Rep: Reputation: 30
Yes you need to translate the source address as the packets go back out.
iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE;
or
iptables -t nat -I POSTROUTING -s 192.168.5.2 -o eth0 -j SNAT --to-source <public ip>;

The first way NATS all private ips to the ip of the firewall. The second one maps only the ssh machine to a uniwue public address. I think you want the second one. I am assuming the eth0 is your external facing nic.
 
Old 01-01-2004, 06:07 PM   #6
clau_bolson
Member
 
Registered: Nov 2003
Location: Argentina
Distribution: Debian Sarge
Posts: 52

Original Poster
Rep: Reputation: 15
ĄSOLVED!
Also I had to add the gateway to the internal machine! (thanks to another question in this forum)
Well, thanks again and a happy new year for you.
 
Old 01-01-2004, 06:08 PM   #7
g-rod
Member
 
Registered: Dec 2003
Location: Long Island, NY USA
Distribution: RedHat, SUSE
Posts: 336

Rep: Reputation: 30
Did you have to add a postroute rule?
 
Old 01-01-2004, 06:20 PM   #8
clau_bolson
Member
 
Registered: Nov 2003
Location: Argentina
Distribution: Debian Sarge
Posts: 52

Original Poster
Rep: Reputation: 15
no, I had to write
route add default gw 192.168.5.37
in the machine I was trying to access (192.168.2.2)

I wrote the three rules in the gateway, yes:
FORWARD
PREROUTING
POSTROUTING

Well, now it works, and that's what matters.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Can't browse Windows computer because of firewall dborzasi Linux - Security 4 11-19-2005 02:56 AM
Linux Firewall with a computer Dark_Sniper* Linux - Networking 1 10-19-2005 12:49 AM
The problem of conneting to the Internet Gins Linux - General 7 07-29-2004 11:36 AM
connecting computer to firewall brandonweinberg Linux - Newbie 2 02-04-2004 09:05 AM
Building router/firewall from a computer apberzerk Linux - Hardware 10 01-13-2004 12:19 PM


All times are GMT -5. The time now is 07:17 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration