2

I have a web server that connects to a 3rd party database server and is granted permission to do so via a firewall rule on the database server.

When I'm developing locally on my laptop, I use an SSH tunnel to connect to the database server via the web server.

ssh web.server.com -L 5678:database.server.com:1234

What I would like to do, if it's even possible, is to set up a firewall rule on the web server that essentially accomplishes the same thing persistently.

So connecting to web.server.com:5678 forwards my connection on to database.server.com:1234 and the database server allows the connection as it's coming from the web server.

Problem is, I'm not really sure where I should start looking for ways to do this.

I'm running Shorewall 3.2.6 on the web server to configure my firewall.

Do I need to start with a VPN or can this be achieved without one?

1
  • 2
    While I consider this to be a good question I also feel I should warn you that you would potentially be opening an extra and undesirable hole to the database server, thereby pretty much killing the protection afforded by the current setup. At the very least you should restrict it to the single source IP addresses you will be connecting from. Apr 29, 2011 at 11:51

3 Answers 3

1

Using Shorewall, you're looking for a DNAT rule (the online documentation is superb, go there). You'll end up with something like

DNAT net loc:192.168.1.3:1234 tcp 5678

in your rules file, where 192.168.1.3 is the IP address of your database server. You may have to enable the routeback option if your incoming connection and your web server's connection to the database server are on the same NIC.

However, I very strongly urge you do not do this!! This opens up your database server to literally anyone, explicitly granting them access to masquerade themselves as your web server and negating any ability for the database server to firewall itself. Additionally, everything you do over this connection would be unencrypted, including your database server username and password! So don't do this! Your SSH tunnel provides authentication and encryption, which this port forwarding would not do.

Also, why are you using such an old version of Shorewall? I've been using Shorewall for years, and when I started version 3 was obsolete! You should at least be on 4.0 by now, or better yet 4.2 or 4.4. Keeping your security software up-to-date is absolutely essential!

0

I guess that you can achieve what you want with something like this (not tested, just from memory and probably wont work, but can give you some hints to start). In the web server try:

iptables -t nat -I PREROUTING -p tcp --dport 5678 -j REDIRECT --to-port 1234
iptables -t nat -A PREROUTING -p tcp --dport 1234 -j DNAT --to-destination database.server.com 

Unless you have your database server directly unreachable from your router, you can do the same just mapping the corresponding ports directly at your router.

However in my opinion you should still using your ssh tunnel because its advantages:

1) the connection require autentification which is good 2) the traffic is encrypted 3) you can tweak your connection whenever you wish with ssh (adding compression, adding more ports to tunnel, adding socks5 bindings, etc...

2
  • 1
    I can just repeat, what hmontoloiu says: Stay with the tunnel. You can write a start script or a regular script to start your tunnel. I would like to add the aspect of using autossh for the connection, since it rebuilds the connection after unwanted disconnects.
    – moestly
    Apr 29, 2011 at 9:40
  • add a .ssh/config file that automatically creates the tunnel whenever you do ssh web.server.com
    – Flashman
    Apr 29, 2011 at 18:35
0

If you don't want to keep the ssh tunnel, you could set up an automatic encrypted VPN like openvpn to do the same. This would keep your server more protected.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .