Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to redirect port A to port B and EXTERNALLY block port B.

A = 9922

B = 22

(Yes, it's ssh, and NO I cannot change it in configuration.)

I have three interfaces:

  • lo (loopback)
  • p36p1 (ethernet) [that's this 'EXTERNALLY']
  • tun0 (vpn)

I have these rules:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
  240 17755 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     tcp  --  tun0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:9922
    0     0 ACCEPT     tcp  --  *      *       127.0.0.0/8          0.0.0.0/0            tcp dpt:22
    4   240 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 32 packets, 3854 bytes)
 pkts bytes target     prot opt in     out     source               destination         

And these for routing:

Chain PREROUTING (policy ACCEPT 1 packets, 60 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    4   240 REDIRECT   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:9922 redir ports 22

Chain INPUT (policy ACCEPT 1 packets, 60 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 1 packets, 68 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REDIRECT   tcp  --  *      lo      0.0.0.0/0            0.0.0.0/0            tcp dpt:9922 redir ports 22

Chain POSTROUTING (policy ACCEPT 1 packets, 68 bytes)
 pkts bytes target     prot opt in     out     source               destination         

This isn't working.

While routing ports are forwarded to localhost? I was checking it out with my fellow admin (I'm a newbie) and he couldn't find it out either. It looked like it was blocked somewhere in beetwen, after routing. But where and why? Have no idea.

And yes, I have googled, and tried all rules I found.

Maybe, just maybe, it's worth mentioning that I'm using iptables, but originally system was shipped with firewalld (fedora 19). I have deactivated them and enabled iptables.

share|improve this question
add comment

1 Answer 1

up vote 0 down vote accepted

When traffic reaches filter (default) table, it has already been modified by nat table, so you have no information about original destination (port 9922).

What you can do, is to mark the traffic incoming to 9922, and then use it to (dis)allow it. (br0 is external interface in this example)

iptables -t nat -A PREROUTING -i br0 -p tcp --dport 9922 -j MARK --set-mark 1
iptables -t nat -A PREROUTING -i br0 -p tcp --dport 9922 -j REDIRECT --to-port 22
iptables -A INPUT -i br0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i br0 -p tcp --dport 22 -m conntrack --ctstate NEW -m mark --mark 1 -j ACCEPT
iptables -A INPUT -i br0 -p tcp --dport 22 -m conntrack --ctstate NEW -j DROP

Edit

There seem to be other way achieving the same. Conntrack has access to original ports after all. This makes marking unnecessary.

iptables -t nat -A PREROUTING -i br0 -p tcp --dport 9922 -j REDIRECT --to-port 22
iptables -A INPUT -i br0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i br0 -p tcp --dport 22 -m conntrack --ctstate NEW --ctorigdstport 9922 -j ACCEPT
iptables -A INPUT -i br0 -p tcp --dport 22 -m conntrack --ctstate NEW -j DROP
share|improve this answer
    
That's exactly what I needed. Big thanks! –  jaor Aug 2 '13 at 6:00
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.