Re: iptables: forwarding port to another machine

From:
Date: 07/16/02 

Date: Tue, 16 Jul 2002 18:34:29 +0200

Mike Martin wrote:
>
> (I understand this isn't quite security ... but your guys know iptables
> best)
>
> I have two machines I would like to be able to ssh into from the internet.
> The first has two NICs and in the gateway to the internet; eth0 connects
> to the internet, eth1 to my LAN. The second machine is located on the
> LAN with a static ip address.
>
> SSH is setup and working properly on both machines from the LAN and on
> the gateway machine you can ssh in from the internet.
>
> What I would like is to add to my iptables firewall some rules that would
> forward packets sent to a designated (non-standard) ssh port on the
> gateway, to the internal machine's port 22.
>
> Basically if you ssh to the gateway I want to get a shell on the gateway.
> If I ssh to a designated alternate port on the gateway, I want to get a
> shell on the internal machine. I'm guessing this can be done fairly easily
> with REDIRECT, but my attemps have failed. Can anyone help?

You should not use REDIRECT. What you need to use is DNAT. Something like:
-A PREROUTING -p tcp -m tcp --dport 54321 -j DNAT --to-destination 192.168.42.42:22 

-- 
Kasper Dupont -- der bruger for meget tid på usenet.
For sending spam use mailto:razrep@daimi.au.dk
or mailto:mcxumhvenwblvtl@skrammel.yaboo.dk

Relevant Pages

  • Re: squid + transparent proxying + ssl prots ?
    ... >> route SSH connections off the local private subnet to the internet. ... We use "net 10" for our lan. ... There is one gateway machine ... The iptables command can be used to perform a range of functions in Linux ...
    (Debian-User)
  • iptables leaves 80/tcp `open ...why?
    ... a linux firewall protects the DMZ & internal lan from the Internet. ... I only wish 22/tcp (SSH) to be allowed into the firewall itself, ... iptables -N bad-if ...
    (comp.os.linux.security)
  • Re: iptables forwarding question
    ... > firewall for my cable internet. ... > currently have a small iptables setup going to forward all the machine ... You want to be able to use regular SSH to connect to any one of these ... SSH uses port 22 - of which you have only one. ...
    (comp.os.linux.networking)
  • Re: FC4 and ssh passphrases not working
    ... I deleted all ssh packages from one of the minor servers and reinstalled them ... Looks like I have several reinstalls to do. ... Assuming your iptables is running on the host itself, ... firewall, and that eth1 is the internet, then something like: ...
    (Fedora)
  • Re: Can iptables do this?
    ... So you can have only firewall without gateway and for so you don't ... > have access to the internet. ... Can I do this with only one network card? ... >> GUI frontend for iptables, runs in GNOME, very easy for managing ...
    (RedHat)
Quantcast