iptables: forwarding SSH connection: eth0 to eth1

hamish · 01-14-2005, 09:35 AM

Hello

I'm trying to forward SSH connections in my LAN from one computer to another using iptables, however, I'm stuck. Yet, I think I'm just about there, if someone could give me a small hand here.

At the moment my internet comes into my flat and is then routed with a linksys router. This has an external IP, and a private one (10.0.0.1). At the moment, my server is set up as a DMZ, and any SSH requests to my flat are sent straight to my server.

Instead, I would like SSH requests to be routed (using iptables) by my server and sent to another computer.

My server has two cards: eth0 10.0.0.2 and eth1 192.168.0.1 . The other computer (call it COMP3) has IP eth0: 192.168.0.1.

At the moment my server and COMP3 can chat to each other (ie they can ping one another, and I can SSH in from one to the other.

I would like that, whenever I SSH to my flat the Linksys router sends the request to my server, and then my server says "oh, this is an SSH request, I ad better send it to COMP3".

So far, Ihave a working firewall on my server (which allows SSH requests) and no firewall on COMP3. The rules which I have written to allow this forwarding are:

Code:

echo "1" > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -p tcp -i eth0 --destination-port 22 -j DNAT --to 192.168.0.2:22
iptables -A FORWARD -i eth0 -o eth1 -p tcp --source-port 22 -d 192.168.0.2 --dport 22 -j ACCEPT

I get no errors when I enter these lines.

as far as I can see, this should work, however, it doesn't and when I SSH to my flat, it doesn't connect to anything (not even my server, like it used to).

Can someone help me? I feel that I'm so close to the end!

Regards
Hamish

edit: I can't set my linksys router up to do this, as I have no spare ports on it.

maxut · 01-14-2005, 09:58 AM

it depends how is iptables configured.
do
iptables -nvL
iptables -t nat -nvL
and post the outputs here. so we can check it.

good luck.

hamish · 01-14-2005, 10:05 AM

hey

root@pi firewall # iptables -nvL

Code:

Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
   19  1872 ACCEPT     all  --  eth0   *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  eth1   *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    0     0 ACCEPT     icmp --  eth0   *       0.0.0.0/0            0.0.0.0/0           icmp type 8
    0     0 ACCEPT     icmp --  eth1   *       0.0.0.0/0            0.0.0.0/0           icmp type 8
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:80
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:443
    0     0 ACCEPT     tcp  --  eth0   *       10.0.0.3             0.0.0.0/0           tcp dpt:10000
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:21
    0     0 ACCEPT     tcp  --  eth0   *       10.0.0.3             0.0.0.0/0           tcp dpt:139
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:873

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     tcp  --  eth0   eth1    0.0.0.0/0            192.168.0.2         tcp spt:22 dpt:22

Chain OUTPUT (policy ACCEPT 26 packets, 1764 bytes)
 pkts bytes target     prot opt in     out     source               destination

iptables -t nat -nvL

Code:

Chain PREROUTING (policy ACCEPT 272K packets, 18M bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22 to:192.168.0.2:22

Chain POSTROUTING (policy ACCEPT 8259 packets, 897K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

thanks
hamish

twsnnva · 01-14-2005, 10:35 AM

Replace

Code:

iptables -t nat -A PREROUTING -p tcp -i eth0 --destination-port 22 -j DNAT --to 192.168.0.2:22
iptables -A FORWARD -i eth0 -o eth1 -p tcp --source-port 22 -d 192.168.0.2 --dport 22 -j ACCEPT

with this

Code:

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 22 -j DNAT --to-destination 192.168.0.2:22
iptables -A FORWARD -p tcp --dport 22 -d 192.168.0.2 -j ACCEPT
iptables -A FORWARD -p tcp --sport 22 -s 192.168.0.2 -j ACCEPT

That should do what you want.

Thomas

hamish · 01-14-2005, 10:44 AM

Hey

I tried that just now, but no luck. Those lines don't tell the computer whcih out interface to use. Does that matter?

Anything else I could have missed?
Hamish

maxut · 01-14-2005, 10:51 AM

if u want to share internet for your computer behind linux also, u may want to visit www.iptables-script.dk to generate iptables script for yourself. it is simple and secure enough.
i hope it will help u.

btw: sorry for bad english

good luck.

EDIT: i think the site moved to http://www.iptables.1go.dk/index1.php

twsnnva · 01-14-2005, 11:03 AM

Quote:

Those lines don't tell the computer whcih out interface to use. Does that matter?

These rules are for any interface as long as the source or dest ip is 192.168.0.2, and the port is 22 it should be forwarded.

This rule should work. It's the same rule that I use, to forward http, https, ssh, and ftp to my DMZ. Try to flush all of the chains.

Code:

iptables -X
iptables -F
iptables -F -t nat

Then run the script.

Also make sure this rule is before anything that could block it. I would make this the first rule in the script, at least for testing purposes.

Thomas

hamish · 01-14-2005, 11:12 AM

and I shouldn't need anything like SNAT, or MASQUERADE, or POSTROUTING rules?

hamish

hamish · 01-14-2005, 11:33 AM

In an effort to simplify everything, I have written rules so that the port which I want to forward is port 1234 (thus I don't mess up chances of sshing into my server).

This means that I want to forward requests to 10.0.0.2:1234 to 192.168.0.2:22 .

Thanks
Hamish

twsnnva · 01-14-2005, 12:46 PM

You should not need SNAT, Masquerade, or POSTROUTING rules. If you want to forward port 1234 to 22, change --dport 22 to --dport 1234 in the PREROUTING rule. You did setup the linksys to forward anything for port 1234 to 10.0.0.2, correct?
If you still can't get connected, here is a very basic ruleset that will forward 1234 to 192.168.0.2:22. It should work, if it doesn't the problem is something else.

Code:

#!/bin/sh
IPTCMD="/sbin/iptables"
$IPTCMD -P INPUT ACCEPT
$IPTCMD -P OUTPUT ACCEPT
$IPTCMD -P FORWARD ACCEPT
$IPTCMD -F
$IPTCMD -F -t nat
$IPTCMD -X
$IPTCMD -Z
$IPTCMD -A PREROUTING -t nat -p tcp  --dport 1234 -j  DNAT --to-destination 192.168.0.2:22

Thomas

hamish · 01-14-2005, 01:47 PM

hello

I have a lot more success now.

However, I'm confused about one thing:
the only way it works at the moment is if I set iptables --policy FORWARD ACCEPT" .

When I have the polilcy set to ACCEPT forwards, it works perfectly, however, whenI turn that off and rely on this line:

Code:

iptables -A FORWARD -p tcp -d $INTERNAL_MACHINE_IP --dport $INTERNAL_MACHINE_PORT -m state --state NEW,ESTABLISHED,RELATED  -j ACCEPT

it doesn't work.

Doing this does work:

Code:

iptables -A FORWARD -p tcp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Do you have any suggestions why that doesn't work? As far as I can see, that is saying that it should accept forwards whcih are either NEW, Established or related.

thanks for everything so far, you have helped me no end!
hamish

twsnnva · 01-14-2005, 02:32 PM

The second rule works because it will allow any tcp packet to be forwarded to any ip, using any port, on any interface. The first rule allows all tcp packets to be forwarded to 192.168.0.2, but will not allow them to be forwarded back to the internet, so a connection cannot be established. I would use a few rules like this.

iptables -A FORWARD -p tcp --dport 22 -d 192.168.0.2 -j ACCEPT
iptables -A FORWARD -p tcp --sport 22 -s 192.168.0.2 -j ACCEPT

Thomas

hamish · 01-14-2005, 03:07 PM

done! and it is working perfectly! thanks so much for all your patience and help.

Now I just have to get COMP3 to be able to ping google and things like that.

Thanks
Hamish