Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i found several tutorials on how to do it, but got none of them to work :/

My setup:

FIREWALL - reachable from the internet - eth0: xxx.xxx.xxx.xxx (public ip) - eth1: 192.168.1.1

SERVER - reachable from FIREWALL - eth0: 192.168.1.5

Because I still want to be able to connect to the firewall on port 22, I would like to forward incoming connections on port 2222 to 192.168.1.5:22.

ping and ssh from FIREWALL to SERVER works. ping and ssh from SERVER to FIREWALL works as well (although login is only allowed with public key and the SERVER is not allowed...)

ping and ssh from anywhere to FIREWALL works.

IP forwarding is enabled:

# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1

Posting my iptables-rules does not make much sense because none of the rules worked (used PREROUTING, POSTROUTING, FORWARD...) and there are no other rules.

Yes, my firewall does not block anything. But this is not about security (yet).

I tried everything I found on the first to pages of: https://www.google.de/search?q=iptables+forward+ssh

Any suggestions?

Regards, Jens

UPDATE Here's the output of tcpdump -n -i any after using Khaled's iptables command:

15:42:33.852718 IP home-ip.56008 > firewall-public-ip.2222: Flags [S], seq 1141341765, win 14600, options [mss 1460,sackOK,TS val 871214 ecr 0,nop,wscale 7], length 0
15:42:33.852752 IP home-ip.56008 > 192.168.1.5.22: Flags [S], seq 1141341765, win 14600, options [mss 1460,sackOK,TS val 871214 ecr 0,nop,wscale 7], length 0

I would have guessed that in the second line there would be something like ... IP 192.168.1.1.45678 > 192.168.1.5.22 ...

These two lines repeat a few times as my ssh-client tries multiple times to connect. But there is not any answer.

2nd Update The routes of the server (192.168.1.5) are here. I just added a route

public-firewall-ip  255.255.255.255      192.168.1.1     192.168.1.5       1

but this has no effect. On the server runs Win XP with cygwin's sshd installed. I did not mention this before because ssh from the firewall to the server works just fine. But when it comes to routing I feel Windows is somewhat limited.

Now I'm installing Wireshark on the server and will paste the result in a few miniutes.

Trace on server The trace on the server shows an arriving SYN on port 22 and a leaving SYN,ACK to my home-ip. I think there is the error. The ACK should be sent to the firewall than be masqueraded because in the leaving package the source IP/Port now is 192.168.1.5:22. No way this reaches my laptop at home behind a NAT... or is there a way?

share|improve this question
    
btw: workaround with ssh port forwarding works... ssh -L 4022:192.168.1.5:22 FIREWALL and then ssh localhost -p 4022 # connects to SERVER –  Jens Aug 26 '12 at 11:28
    
The trace shown in your update indicates that there is no problem in your firewall machine config. It is forwarding the request to the server 192.168.1.5 (2nd packet). The problem should be in the server machine. It may be a routing issue. Can you post the routing table of the server machine 192.168.1.5? –  Khaled Aug 27 '12 at 6:25
    
The ACK should be sent to the home-ip but via the firewall machine. In other words, destination IP should be home-ip and destination MAC should be firewall-mac. –  Khaled Aug 27 '12 at 10:38
    
Any way I can tell Windows to do just that? –  Jens Aug 27 '12 at 10:45
    
All you need to do is to make sure that the firewall IP is the default gateway of this Windows machine. That's it. –  Khaled Aug 27 '12 at 10:55

1 Answer 1

up vote 3 down vote accepted

If you are allowing the traffic to pass through your firewall and have IP forwarding enabled, you just need one NAT rule to forward SSH traffic on port 2222. A one like this should do the work:

$ iptables -t nat -A PREROUTING -d x.x.x.x -p tcp --dport 2222 -j DNAT --to-destination 192.168.1.5:22

Update:

Network sniffer is your friend when debugging such problems. You can run tcpdump on the firewall machine and see if you can catch the request coming and the same request should leave the firewall machine.

share|improve this answer
    
Is there any way to debug? If I try to connect, I get ssh: connect to host FIREWALL port 2222: Connection timed out. output of iptables-save –  Jens Aug 26 '12 at 12:16
    
@Jens: You can use network sniffer as indicated in the updated answer. Post your results to help you analyzing it. –  Khaled Aug 26 '12 at 12:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.