Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to access a Linux box via SSH & Samba that is hidden/connected behind another one.

Setup :-

 A        switch    B         C
|----|    |---|    |----|    |----|
|eth0|----|   |----|eth0|    |    |
|----|    |---|    |eth1|----|eth1|
                   |----|    |----|

Eg, SSH/Samba from A to C

How does one go about this?
I was thinking that it cannot be done via IP alone? Or can it?

Could B say "hi on eth0, if your looking for, its here on eth1"?
Is this NAT? This is a large private network, so what about if another PC has that IP?!

More likely it would be PAT?
A would say "hi"
B would say "hi on eth0, traffic for port 1234 goes on here eth1"
How could that be done?

And would the SSH/Samba demons see the correct packet header info and work??

IP info :-

A - eth0 -
B - eth0 - B1 = B2 =
  - eth1 -
C - eth1 -

A, B & C are RHEL (RedHat) But Windows computers can be connected to the switch. I configured the 192.168.0.* IPs, they are changeable.

Update after response from Eddie

Few problems (and Machines' B IP is different!)

From A :-
ssh works ok, (can get to B2)
but ssh -p 2022 -vv times out with :-

OpenSSH_4.3p2, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to [] port 2022.
...wait ages...
debug1: connect to address port 2022: Connection timed out
ssh: connect to host port 2022: Connection timed out

From B2 :-

$ service iptables status
Table: filter
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination
1    ACCEPT     tcp  --           tcp dpt:22

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

Table: nat
num  target     prot opt source               destination
1    DNAT       tcp  --             tcp dpt:2022 to:

num  target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

And ssh from B2 to C works fine :-

$ ssh

Route info :-

$ route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface     *        U     0      0        0 eth1     *        U     0      0        0 eth0     *          U     0      0        0 eth1
default         UG    0      0        0 eth0

$ ip route dev eth1  proto kernel  scope link  src dev eth0  proto kernel  scope link  src dev eth1  scope link
default via dev eth0

So I just dont know why the port forward doesnt work from A to B2?

share|improve this question

What you have termed PAT would work. You will need to have iptables running(or some customizable firewall). Then run the following commands:

iptables -t nat -A PREROUTING -p tcp --dport 22 -p DNAT --to-destination
iptables -t nat -A PREROUTING -p tcp --dport 135:139 -p DNAT --to-destination
iptables -t nat -A PREROUTING -p tcp --dport 445 -p DNAT --to-destination
service iptables save
echo 1 > /proc/sys/net/ipv4/ip_forward

In the file /etc/sysctl.conf, change the line:

net.ipv4.ip_forward = 0


net.ipv4.ip_forward = 1
share|improve this answer


On B:

#Arbitrary port
iptables -t nat -I PREROUTING -p tcp --dport $SOME_PORT -j DNAT --to-destination
iptables -I FORWARD -p tcp --dport 22 -d -j ACCEPT
#On a machine type A:
ssh -p $SOME_PORT

For Samba

Is it possible to mount C shares via nfs on B then setup samba on B? If not, then you can redirect the samba ports:

iptables -t nat -I PREROUTING -p tcp -m multiport –dports 139,445 -j DNAT --to-destination
iptables -t nat -I PREROUTING -p udp –dport 137:138 -j DNAT --to-destination

If samba is already running on B, then you could bind an additional IP address on B and forward to C (you could do this for ssh also to keep port 22. Be wary of services starting on the address):

ifconfig eth0:1 netmask

iptables -t nat -I PREROUTING -d -p tcp --dport 22 -j DNAT --to-destination
iptables -t nat -I PREROUTING -d -p tcp -m multiport –dports 139,445 -j DNAT --to-destination
iptables -t nat -I PREROUTING -d -p udp –dport 137:138 -j DNAT --to-destination

EDIT I see you're still having problems; make sure that:

  • Machine B has ip forwarding enabled : echo 1 > /proc/sys/net/ipv4/ip_forward
  • Machine C has a route back to the user via machine B. If not, then set a masquerade rule on machine B :

    iptables -t nat -I POSTROUTING -d -p tcp --dport 22 -j MASQUERADE

tcpdump can be useful to troubleshoot. On machine B:

#capture and display packets heading to
tcpdump -i any -p tcp ip host and port 22
share|improve this answer
small note just for ref : "ssh -p $SOME_PORT" => "ssh <B_ip_addr> -p $SOME_PORT" – IanVaughan Apr 29 '10 at 15:50

Hmmm. Well, assuming that the switch always routes traffic to machine B, you can just do:

route add -net netmask dev eth1

That should tell machine B that, if traffic comes in for the, send it out eth1.

That should work, and it's a bit easier than setting up a NAT. You'll need to make sure the switch knows to route traffic for to (Eth 0 on B).

@Ian: Routing isn't necessarily easy, but it's not that hard either. That's what routers do. Assuming your switch is just a switch, with no routing capability, you can't use it to set the route, but you have to have a router somewhere or your network is purely a local LAN with no internet access.

Check your machines, and find out where the default gateway is (on the linux boxes you can just type route with no arguments. Your default gateway route is the one that looks like:

default         UG    0      0        0 eth0

That's your "core" router. that's the machine all the machines look to to figure out where machines on other subnets are. That's where you need to add a route pointing to the B machine as the gateway router for the subnet.

If you can give me some information on your router, I can tell you how to add that route.

share|improve this answer
That's a nice idea, but I have simplified the network diagram, there are many machines like A, and some have many hops, but they can all access B-eth0 ok. As you state, getting traffic for to KNOW to goto would be hard?! So this makes this solution not workable. Thanks. – IanVaughan Apr 29 '10 at 13:43
Thanks again, excellent idea, and your right, that would work! IF... I was allowed to change the main router. But I am within a company network, and thus cannot do that! (I have had them set routing for my subnet, ->, but I was pushing my luck getting that!) Any anyway, I am actually after a different solution for transparency and portability. So again, many thanks... – IanVaughan Apr 29 '10 at 16:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.