iptables: forwarding SSH connection: eth0 to eth1
Hello
I'm trying to forward SSH connections in my LAN from one computer to another using iptables, however, I'm stuck. Yet, I think I'm just about there, if someone could give me a small hand here. At the moment my internet comes into my flat and is then routed with a linksys router. This has an external IP, and a private one (10.0.0.1). At the moment, my server is set up as a DMZ, and any SSH requests to my flat are sent straight to my server. Instead, I would like SSH requests to be routed (using iptables) by my server and sent to another computer. My server has two cards: eth0 10.0.0.2 and eth1 192.168.0.1 . The other computer (call it COMP3) has IP eth0: 192.168.0.1. At the moment my server and COMP3 can chat to each other (ie they can ping one another, and I can SSH in from one to the other. I would like that, whenever I SSH to my flat the Linksys router sends the request to my server, and then my server says "oh, this is an SSH request, I ad better send it to COMP3". So far, Ihave a working firewall on my server (which allows SSH requests) and no firewall on COMP3. The rules which I have written to allow this forwarding are: Code:
echo "1" > /proc/sys/net/ipv4/ip_forward as far as I can see, this should work, however, it doesn't and when I SSH to my flat, it doesn't connect to anything (not even my server, like it used to). Can someone help me? I feel that I'm so close to the end! Regards Hamish edit: I can't set my linksys router up to do this, as I have no spare ports on it. |
it depends how is iptables configured.
do iptables -nvL iptables -t nat -nvL and post the outputs here. so we can check it. good luck. |
hey
root@pi firewall # iptables -nvL Code:
Chain INPUT (policy DROP 0 packets, 0 bytes) Code:
Chain PREROUTING (policy ACCEPT 272K packets, 18M bytes) hamish |
Replace
Code:
iptables -t nat -A PREROUTING -p tcp -i eth0 --destination-port 22 -j DNAT --to 192.168.0.2:22 Code:
iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 22 -j DNAT --to-destination 192.168.0.2:22 Thomas |
Hey
I tried that just now, but no luck. Those lines don't tell the computer whcih out interface to use. Does that matter? Anything else I could have missed? Hamish |
if u want to share internet for your computer behind linux also, u may want to visit www.iptables-script.dk to generate iptables script for yourself. it is simple and secure enough.
i hope it will help u. btw: sorry for bad english good luck. EDIT: i think the site moved to http://www.iptables.1go.dk/index1.php |
Quote:
This rule should work. It's the same rule that I use, to forward http, https, ssh, and ftp to my DMZ. Try to flush all of the chains. Code:
iptables -X Also make sure this rule is before anything that could block it. I would make this the first rule in the script, at least for testing purposes. Thomas |
and I shouldn't need anything like SNAT, or MASQUERADE, or POSTROUTING rules?
hamish |
In an effort to simplify everything, I have written rules so that the port which I want to forward is port 1234 (thus I don't mess up chances of sshing into my server).
This means that I want to forward requests to 10.0.0.2:1234 to 192.168.0.2:22 . Thanks Hamish |
You should not need SNAT, Masquerade, or POSTROUTING rules. If you want to forward port 1234 to 22, change --dport 22 to --dport 1234 in the PREROUTING rule. You did setup the linksys to forward anything for port 1234 to 10.0.0.2, correct?
If you still can't get connected, here is a very basic ruleset that will forward 1234 to 192.168.0.2:22. It should work, if it doesn't the problem is something else. Code:
#!/bin/sh Thomas |
hello
I have a lot more success now. However, I'm confused about one thing: the only way it works at the moment is if I set iptables --policy FORWARD ACCEPT" . When I have the polilcy set to ACCEPT forwards, it works perfectly, however, whenI turn that off and rely on this line: Code:
iptables -A FORWARD -p tcp -d $INTERNAL_MACHINE_IP --dport $INTERNAL_MACHINE_PORT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT Doing this does work: Code:
iptables -A FORWARD -p tcp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT thanks for everything so far, you have helped me no end! hamish |
The second rule works because it will allow any tcp packet to be forwarded to any ip, using any port, on any interface. The first rule allows all tcp packets to be forwarded to 192.168.0.2, but will not allow them to be forwarded back to the internet, so a connection cannot be established. I would use a few rules like this.
iptables -A FORWARD -p tcp --dport 22 -d 192.168.0.2 -j ACCEPT iptables -A FORWARD -p tcp --sport 22 -s 192.168.0.2 -j ACCEPT Thomas |
done! and it is working perfectly! thanks so much for all your patience and help.
Now I just have to get COMP3 to be able to ping google and things like that. Thanks Hamish |
All times are GMT -5. The time now is 01:47 AM. |