LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 01-14-2005, 09:35 AM   #1
hamish
Member
 
Registered: Aug 2003
Location: Edinburgh
Distribution: Server: Gentoo2004; Desktop: Ubuntu
Posts: 720

Rep: Reputation: 30
iptables: forwarding SSH connection: eth0 to eth1


Hello

I'm trying to forward SSH connections in my LAN from one computer to another using iptables, however, I'm stuck. Yet, I think I'm just about there, if someone could give me a small hand here.

At the moment my internet comes into my flat and is then routed with a linksys router. This has an external IP, and a private one (10.0.0.1). At the moment, my server is set up as a DMZ, and any SSH requests to my flat are sent straight to my server.

Instead, I would like SSH requests to be routed (using iptables) by my server and sent to another computer.

My server has two cards: eth0 10.0.0.2 and eth1 192.168.0.1 . The other computer (call it COMP3) has IP eth0: 192.168.0.1.

At the moment my server and COMP3 can chat to each other (ie they can ping one another, and I can SSH in from one to the other.

I would like that, whenever I SSH to my flat the Linksys router sends the request to my server, and then my server says "oh, this is an SSH request, I ad better send it to COMP3".

So far, Ihave a working firewall on my server (which allows SSH requests) and no firewall on COMP3. The rules which I have written to allow this forwarding are:

Code:
echo "1" > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -p tcp -i eth0 --destination-port 22 -j DNAT --to 192.168.0.2:22
iptables -A FORWARD -i eth0 -o eth1 -p tcp --source-port 22 -d 192.168.0.2 --dport 22 -j ACCEPT
I get no errors when I enter these lines.

as far as I can see, this should work, however, it doesn't and when I SSH to my flat, it doesn't connect to anything (not even my server, like it used to).

Can someone help me? I feel that I'm so close to the end!

Regards
Hamish

edit: I can't set my linksys router up to do this, as I have no spare ports on it.

Last edited by hamish; 01-14-2005 at 09:39 AM.
 
Old 01-14-2005, 09:58 AM   #2
maxut
Senior Member
 
Registered: May 2003
Location: istanbul
Distribution: debian - redhat - others
Posts: 1,188

Rep: Reputation: 50
it depends how is iptables configured.
do
iptables -nvL
iptables -t nat -nvL
and post the outputs here. so we can check it.

good luck.
 
Old 01-14-2005, 10:05 AM   #3
hamish
Member
 
Registered: Aug 2003
Location: Edinburgh
Distribution: Server: Gentoo2004; Desktop: Ubuntu
Posts: 720

Original Poster
Rep: Reputation: 30
hey

root@pi firewall # iptables -nvL
Code:
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
   19  1872 ACCEPT     all  --  eth0   *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  eth1   *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    0     0 ACCEPT     icmp --  eth0   *       0.0.0.0/0            0.0.0.0/0           icmp type 8
    0     0 ACCEPT     icmp --  eth1   *       0.0.0.0/0            0.0.0.0/0           icmp type 8
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:80
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:443
    0     0 ACCEPT     tcp  --  eth0   *       10.0.0.3             0.0.0.0/0           tcp dpt:10000
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:21
    0     0 ACCEPT     tcp  --  eth0   *       10.0.0.3             0.0.0.0/0           tcp dpt:139
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:873

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     tcp  --  eth0   eth1    0.0.0.0/0            192.168.0.2         tcp spt:22 dpt:22

Chain OUTPUT (policy ACCEPT 26 packets, 1764 bytes)
 pkts bytes target     prot opt in     out     source               destination
iptables -t nat -nvL
Code:
Chain PREROUTING (policy ACCEPT 272K packets, 18M bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22 to:192.168.0.2:22

Chain POSTROUTING (policy ACCEPT 8259 packets, 897K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
thanks
hamish
 
Old 01-14-2005, 10:35 AM   #4
twsnnva
Member
 
Registered: Oct 2003
Location: Newport News, Va
Distribution: Debian
Posts: 246

Rep: Reputation: 30
Replace
Code:
iptables -t nat -A PREROUTING -p tcp -i eth0 --destination-port 22 -j DNAT --to 192.168.0.2:22
iptables -A FORWARD -i eth0 -o eth1 -p tcp --source-port 22 -d 192.168.0.2 --dport 22 -j ACCEPT
with this

Code:
iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 22 -j DNAT --to-destination 192.168.0.2:22
iptables -A FORWARD -p tcp --dport 22 -d 192.168.0.2 -j ACCEPT
iptables -A FORWARD -p tcp --sport 22 -s 192.168.0.2 -j ACCEPT
That should do what you want.

Thomas
 
Old 01-14-2005, 10:44 AM   #5
hamish
Member
 
Registered: Aug 2003
Location: Edinburgh
Distribution: Server: Gentoo2004; Desktop: Ubuntu
Posts: 720

Original Poster
Rep: Reputation: 30
Hey

I tried that just now, but no luck. Those lines don't tell the computer whcih out interface to use. Does that matter?

Anything else I could have missed?
Hamish
 
Old 01-14-2005, 10:51 AM   #6
maxut
Senior Member
 
Registered: May 2003
Location: istanbul
Distribution: debian - redhat - others
Posts: 1,188

Rep: Reputation: 50
if u want to share internet for your computer behind linux also, u may want to visit www.iptables-script.dk to generate iptables script for yourself. it is simple and secure enough.
i hope it will help u.

btw: sorry for bad english

good luck.

EDIT: i think the site moved to http://www.iptables.1go.dk/index1.php


Last edited by maxut; 01-14-2005 at 11:04 AM.
 
Old 01-14-2005, 11:03 AM   #7
twsnnva
Member
 
Registered: Oct 2003
Location: Newport News, Va
Distribution: Debian
Posts: 246

Rep: Reputation: 30
Quote:
Those lines don't tell the computer whcih out interface to use. Does that matter?
These rules are for any interface as long as the source or dest ip is 192.168.0.2, and the port is 22 it should be forwarded.

This rule should work. It's the same rule that I use, to forward http, https, ssh, and ftp to my DMZ. Try to flush all of the chains.

Code:
iptables -X
iptables -F
iptables -F -t nat
Then run the script.

Also make sure this rule is before anything that could block it. I would make this the first rule in the script, at least for testing purposes.

Thomas
 
Old 01-14-2005, 11:12 AM   #8
hamish
Member
 
Registered: Aug 2003
Location: Edinburgh
Distribution: Server: Gentoo2004; Desktop: Ubuntu
Posts: 720

Original Poster
Rep: Reputation: 30
and I shouldn't need anything like SNAT, or MASQUERADE, or POSTROUTING rules?

hamish
 
Old 01-14-2005, 11:33 AM   #9
hamish
Member
 
Registered: Aug 2003
Location: Edinburgh
Distribution: Server: Gentoo2004; Desktop: Ubuntu
Posts: 720

Original Poster
Rep: Reputation: 30
In an effort to simplify everything, I have written rules so that the port which I want to forward is port 1234 (thus I don't mess up chances of sshing into my server).

This means that I want to forward requests to 10.0.0.2:1234 to 192.168.0.2:22 .

Thanks
Hamish

Last edited by hamish; 01-14-2005 at 12:04 PM.
 
Old 01-14-2005, 12:46 PM   #10
twsnnva
Member
 
Registered: Oct 2003
Location: Newport News, Va
Distribution: Debian
Posts: 246

Rep: Reputation: 30
You should not need SNAT, Masquerade, or POSTROUTING rules. If you want to forward port 1234 to 22, change --dport 22 to --dport 1234 in the PREROUTING rule. You did setup the linksys to forward anything for port 1234 to 10.0.0.2, correct?
If you still can't get connected, here is a very basic ruleset that will forward 1234 to 192.168.0.2:22. It should work, if it doesn't the problem is something else.
Code:
#!/bin/sh
IPTCMD="/sbin/iptables"
$IPTCMD -P INPUT ACCEPT
$IPTCMD -P OUTPUT ACCEPT
$IPTCMD -P FORWARD ACCEPT
$IPTCMD -F
$IPTCMD -F -t nat
$IPTCMD -X
$IPTCMD -Z
$IPTCMD -A PREROUTING -t nat -p tcp  --dport 1234 -j  DNAT --to-destination 192.168.0.2:22


Thomas

Last edited by twsnnva; 01-14-2005 at 12:48 PM.
 
Old 01-14-2005, 01:47 PM   #11
hamish
Member
 
Registered: Aug 2003
Location: Edinburgh
Distribution: Server: Gentoo2004; Desktop: Ubuntu
Posts: 720

Original Poster
Rep: Reputation: 30
hello

I have a lot more success now.

However, I'm confused about one thing:
the only way it works at the moment is if I set iptables --policy FORWARD ACCEPT" .

When I have the polilcy set to ACCEPT forwards, it works perfectly, however, whenI turn that off and rely on this line:
Code:
iptables -A FORWARD -p tcp -d $INTERNAL_MACHINE_IP --dport $INTERNAL_MACHINE_PORT -m state --state NEW,ESTABLISHED,RELATED  -j ACCEPT
it doesn't work.

Doing this does work:
Code:
iptables -A FORWARD -p tcp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
Do you have any suggestions why that doesn't work? As far as I can see, that is saying that it should accept forwards whcih are either NEW, Established or related.

thanks for everything so far, you have helped me no end!
hamish

Last edited by hamish; 01-14-2005 at 02:09 PM.
 
Old 01-14-2005, 02:32 PM   #12
twsnnva
Member
 
Registered: Oct 2003
Location: Newport News, Va
Distribution: Debian
Posts: 246

Rep: Reputation: 30
The second rule works because it will allow any tcp packet to be forwarded to any ip, using any port, on any interface. The first rule allows all tcp packets to be forwarded to 192.168.0.2, but will not allow them to be forwarded back to the internet, so a connection cannot be established. I would use a few rules like this.

iptables -A FORWARD -p tcp --dport 22 -d 192.168.0.2 -j ACCEPT
iptables -A FORWARD -p tcp --sport 22 -s 192.168.0.2 -j ACCEPT

Thomas
 
Old 01-14-2005, 03:07 PM   #13
hamish
Member
 
Registered: Aug 2003
Location: Edinburgh
Distribution: Server: Gentoo2004; Desktop: Ubuntu
Posts: 720

Original Poster
Rep: Reputation: 30
done! and it is working perfectly! thanks so much for all your patience and help.

Now I just have to get COMP3 to be able to ping google and things like that.

Thanks
Hamish
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
forwarding a specific port from eth0 to eth1 zovres Linux - Networking 2 05-02-2006 10:01 PM
SSH tunnel or Iptables forwarding jatro Linux - Networking 5 06-15-2005 03:07 AM
port forwarding from eth0 to eth1 ? overproof Linux - Networking 7 05-16-2005 02:48 AM
iptables/forwarding connection phatboyz Linux - Networking 0 01-05-2005 12:02 PM
IP forwarding from eth0 to eth1 musicman_ace Linux - Networking 5 08-01-2004 04:39 AM


All times are GMT -5. The time now is 10:55 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration