Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got my SSH server listening on port 555. I need to allow one IP to connect to port 22 and then have the IPTables redirect this connection to 555 (this is because the software connecting to port 22 can only connect to port 22).

My current IPTables rules are as follows:

 Chain INPUT (policy ACCEPT)
 target     prot opt source               destination         
 ACCEPT     udp  --  anywhere             anywhere            udp dpt:domain 
 ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:domain 
 ACCEPT     udp  --  anywhere             anywhere            udp dpt:bootps 
 ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:bootps 
 ACCEPT     udp  --  anywhere             anywhere            udp dpt:domain 
 ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:domain 
 ACCEPT     udp  --  anywhere             anywhere            udp dpt:bootps 
 ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:bootps 
 ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
 ACCEPT     icmp --  anywhere             anywhere            
 ACCEPT     all  --  anywhere             anywhere            
 ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ms-wbt-server 
 ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp multiport dports 5901:5903,6001:6003 
 DROP       tcp  --  anywhere             anywhere            tcp dpt:telnet 
 DROP       tcp  --  anywhere             anywhere            tcp dpt:telnet 
 DROP       tcp  --  anywhere             anywhere            tcp dpt:sunrpc 
 DROP       tcp  --  anywhere             anywhere            tcp dpt:ircu-2 
 DROP       tcp  --  anywhere             anywhere            tcp dpt:ircu-3 
 DROP       tcp  --  anywhere             anywhere            tcp dpt:ircu-4 
 DROP       tcp  --  anywhere             anywhere            tcp dpt:ircu-5 
 DROP       tcp  --  anywhere             anywhere            tcp dpt:telnet 
 DROP       tcp  --  anywhere             anywhere            tcp dpt:ms-wbt-server 
 DROP       tcp  --  anywhere             anywhere            tcp dpt:5666 
 DROP       tcp  --  anywhere             anywhere            tcp dpt:5903 

 Chain FORWARD (policy ACCEPT)
 target     prot opt source               destination         
 ACCEPT     all  --  anywhere             192.168.100.0/24    
 ACCEPT     all  --  192.168.100.0/24     anywhere            
 ACCEPT     all  --  anywhere             anywhere            
 REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 
 REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 
 ACCEPT     all  --  anywhere             192.168.122.0/24    state RELATED,ESTABLISHED 
 ACCEPT     all  --  192.168.122.0/24     anywhere            
 ACCEPT     all  --  anywhere             anywhere            
 REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 
 REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 
 TCPMSS     tcp  --  172.16.36.0/24       anywhere            tcp flags:FIN,SYN,RST,ACK/SYN TCPMSS set 1356 

 Chain OUTPUT (policy ACCEPT)
 target     prot opt source               destination   

Am I right in saying that the following rules will do what I want? (Assume 192.168.8.8 is the IP I want to be able to connect to 22).

 iptables -A INPUT -s 192.168.8.8 -p tcp -m tcp --dport 22 -j ACCEPT
 iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 22 -j REDIRECT --to-port 678

Any help is appreciated. Thanks!

share|improve this question
    
Why don't you just have ssh listen on port 22, then? –  Michael Hampton Jun 6 '13 at 18:41
add comment

1 Answer

If you want it to get redirected to Port 555, you should use

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 22 -j REDIRECT --to-port 555

instead of

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 22 -j REDIRECT --to-port 678

Apart from that, your rules are correct.

Additionally, with your current configuration, you won't need the INPUT rule as you currently don't block connections to Port 22 (your INPUT policy is set to ACCEPT).

share|improve this answer
    
Sorry, slight mistake. But thats excellent. Thanks! –  Adam Jun 6 '13 at 11:40
    
I've edited my answer. –  etagenklo Jun 6 '13 at 11:42
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.