I'm trying to set up port forwarding so that a specific IP (e.g 220.127.116.11/32) can SSH via a bastion (e.g 18.104.22.168:2222) to an app server (10.3.3.3:22). The bastion and app server are running in a VPC in Amazon with only the bastion exposed to the Internet.
I'm using the following rule on the bastion (I've left out the source IP until I get it working):
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 2222 -j DNAT --to 10.3.3.3:22
but when I try to connect, I get no response.
Running tcpdump on the bastion shows that traffic is getting through, so I assume I'm hitting the app server's VPC security groups and not getting as far as port 22 on it. I think this is happening because while the the bastion has permission to access port 22 on the app server, IP 22.214.171.124 doesn't.
So, my question is: Does NAT-ing the way I've set it up automatically change the source IP of packets so they appear to come from the bastion, or will they contain the original source IP, in this case 126.96.36.199?
If packets do contain 188.8.131.52 as the source IP after forwarding them, how can I change the source address to be the bastion's?
I guess specifically for SSH I could set up SSH tunnelling, but I also need a similar solution to allow access to port 443 on several different app servers.
I've now tried adding SNAT as well with:
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 10.2.2.2
but it still doesn't work (10.2.2.2 is the internal IP of the bastion).