I have a router running DD-WRT. In my network I have a NAS device which runs an OpenSSH server. I want to be able to access the OpenSSH server from outside the LAN.
This is accomplished by adding rules to iptables
The router has configured:
- OpenVPN client
- DDNS
Assumming:
<routerIp>
the internal router IP<routerPort>
the port on router for listening the incoming traffic<nasIP>
the internal NAS IP<nasPort>
the OpenSSH server port on NAS
Also currently I have <routerPort>
== <nasPort>
I have to:
- open a port on the router
- route the traffic coming to this port to NAS.
The rules that should accomplish this task, but not working, are:
iptables -A FORWARD -i tun1 -p tcp -d <nasIP> --dport <nasPort> -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -d <routerIp> --dport <routerPort> -j DNAT --to-destination <nasIP>:<nasPort>
References:
- Port Forwarding to a specific LAN_IP - DD-WRT Wiki - iptables
- Iptables forward all traffic to a specified port, to another device
- Use iptables to forward ssh
- Forward SSH to another Host
EDIT according RalfFriedl's answer:
Changed the rules to:
iptables -A FORWARD -i tun1 -p tcp -d <nasIP> --dport <nasPort> -j ACCEPT
iptables -t nat -A PREROUTING -i tun1 -p tcp --dport <nasPort> -j DNAT --to-destination <nasIP>:<nasPort>
but didn't work either
How can I get the external IP?
EDIT output of ip a
:
1: lo: mtu 65536 qdisc noqueue
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: imq0: mtu 1500 qdisc fq_codel qlen 30
link/void
3: imq1: mtu 16000 qdisc fq_codel qlen 11000
link/void
4: eth0: mtu 1492 qdisc htb qlen 1000
link/ether dc:ef:09:f2:87:e9 brd ff:ff:ff:ff:ff:ff
inet 192.168.100.3/24 brd 192.168.100.255 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::deef:9ff:fef2:87e9/64 scope link
valid_lft forever preferred_lft forever
5: eth1: mtu 1500 qdisc fq_codel master br0 qlen 1000
link/ether dc:ef:09:f2:87:e8 brd ff:ff:ff:ff:ff:ff
inet6 fe80::deef:9ff:fef2:87e8/64 scope link
valid_lft forever preferred_lft forever
6: teql0: mtu 1500 qdisc noop qlen 100
link/void
19: ip6tnl0@NONE: mtu 1452 qdisc noop
link/tunnel6 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 brd 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00
20: br0: mtu 1500 qdisc noqueue
link/ether dc:ef:09:f2:87:e8 brd ff:ff:ff:ff:ff:ff
inet 169.254.255.1/16 brd 169.254.255.255 scope global br0:0
valid_lft forever preferred_lft forever
inet 192.168.2.1/24 brd 192.168.2.255 scope global br0
valid_lft forever preferred_lft forever
inet6 fe80::deef:9ff:fef2:87e8/64 scope link
valid_lft forever preferred_lft forever
21: ath0: mtu 1500 qdisc noqueue master br0
link/ether 0a:b1:2c:d4:5e:f0 brd ff:ff:ff:ff:ff:ff
inet6 fe80::8b1:2cff:fed4:5ef0/64 scope link
valid_lft forever preferred_lft forever
22: ath0.1: mtu 1500 qdisc noqueue
link/ether 08:b1:2c:d4:5e:f0 brd ff:ff:ff:ff:ff:ff
inet 172.16.1.1/24 brd 172.16.1.255 scope global ath0.1
valid_lft forever preferred_lft forever
inet6 fe80::ab1:2cff:fed4:5ef0/64 scope link
valid_lft forever preferred_lft forever
23: ath1: mtu 1500 qdisc noqueue master br0
link/ether dc:ef:09:f2:87:eb brd ff:ff:ff:ff:ff:ff
inet6 fe80::deef:9ff:fef2:87eb/64 scope link
valid_lft forever preferred_lft forever
24: tun1: mtu 1500 qdisc fq_codel qlen 100
link/[65534]
inet 10.128.250.xxx/16 brd 10.128.255.xxx scope global tun1
valid_lft forever preferred_lft forever