3

i found several tutorials on how to do it, but got none of them to work :/

My setup:

FIREWALL - reachable from the internet - eth0: xxx.xxx.xxx.xxx (public ip) - eth1: 192.168.1.1

SERVER - reachable from FIREWALL - eth0: 192.168.1.5

Because I still want to be able to connect to the firewall on port 22, I would like to forward incoming connections on port 2222 to 192.168.1.5:22.

ping and ssh from FIREWALL to SERVER works. ping and ssh from SERVER to FIREWALL works as well (although login is only allowed with public key and the SERVER is not allowed...)

ping and ssh from anywhere to FIREWALL works.

IP forwarding is enabled:

# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1

Posting my iptables-rules does not make much sense because none of the rules worked (used PREROUTING, POSTROUTING, FORWARD...) and there are no other rules.

Yes, my firewall does not block anything. But this is not about security (yet).

I tried everything I found on the first to pages of: https://www.google.de/search?q=iptables+forward+ssh

Any suggestions?

Regards, Jens

UPDATE Here's the output of tcpdump -n -i any after using Khaled's iptables command:

15:42:33.852718 IP home-ip.56008 > firewall-public-ip.2222: Flags [S], seq 1141341765, win 14600, options [mss 1460,sackOK,TS val 871214 ecr 0,nop,wscale 7], length 0
15:42:33.852752 IP home-ip.56008 > 192.168.1.5.22: Flags [S], seq 1141341765, win 14600, options [mss 1460,sackOK,TS val 871214 ecr 0,nop,wscale 7], length 0

I would have guessed that in the second line there would be something like ... IP 192.168.1.1.45678 > 192.168.1.5.22 ...

These two lines repeat a few times as my ssh-client tries multiple times to connect. But there is not any answer.

2nd Update The routes of the server (192.168.1.5) are here. I just added a route 

public-firewall-ip  255.255.255.255      192.168.1.1     192.168.1.5       1

but this has no effect. On the server runs Win XP with cygwin's sshd installed. I did not mention this before because ssh from the firewall to the server works just fine. But when it comes to routing I feel Windows is somewhat limited.

Now I'm installing Wireshark on the server and will paste the result in a few miniutes.

Trace on server The trace on the server shows an arriving SYN on port 22 and a leaving SYN,ACK to my home-ip. I think there is the error. The ACK should be sent to the firewall than be masqueraded because in the leaving package the source IP/Port now is 192.168.1.5:22. No way this reaches my laptop at home behind a NAT... or is there a way?

Jens
  • 342
  • 1
  • 4
  • 14
  • btw: workaround with ssh port forwarding works... `ssh -L 4022:192.168.1.5:22 FIREWALL` and then `ssh localhost -p 4022 # connects to SERVER` – Jens Aug 26 '12 at 11:28
  • The trace shown in your update indicates that there is no problem in your firewall machine config. It is forwarding the request to the server 192.168.1.5 (2nd packet). The problem should be in the server machine. It may be a routing issue. Can you post the routing table of the server machine `192.168.1.5`? – Khaled Aug 27 '12 at 06:25
  • The ACK should be sent to the home-ip but via the firewall machine. In other words, destination IP should be home-ip and destination MAC should be firewall-mac. – Khaled Aug 27 '12 at 10:38
  • Any way I can tell Windows to do just that? – Jens Aug 27 '12 at 10:45
  • All you need to do is to make sure that the firewall IP is the default gateway of this Windows machine. That's it. – Khaled Aug 27 '12 at 10:55
  • Wow, thanks. That fixed it. Even though first I thought now it would become impossible because the Win machine has two nics, one behind another dhcp server with access to internet **the other** to the "firewall", 192.168.1.1 (without internet access). – Jens Aug 27 '12 at 11:10

1 Answers1

3

If you are allowing the traffic to pass through your firewall and have IP forwarding enabled, you just need one NAT rule to forward SSH traffic on port 2222. A one like this should do the work:

$ iptables -t nat -A PREROUTING -d x.x.x.x -p tcp --dport 2222 -j DNAT --to-destination 192.168.1.5:22

Update:

Network sniffer is your friend when debugging such problems. You can run tcpdump on the firewall machine and see if you can catch the request coming and the same request should leave the firewall machine.

Khaled
  • 35,688
  • 8
  • 69
  • 98
  • Is there any way to debug? If I try to connect, I get `ssh: connect to host FIREWALL port 2222: Connection timed out`. [output of iptables-save](http://paste.jdsv.de/view/18029359) – Jens Aug 26 '12 at 12:16
  • @Jens: You can use network sniffer as indicated in the updated answer. Post your results to help you analyzing it. – Khaled Aug 26 '12 at 12:25