Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to set up port forwarding so that a specific IP (e.g 1.2.3.4/32) can SSH via a bastion (e.g 5.5.5.5:2222) to an app server (10.3.3.3:22). The bastion and app server are running in a VPC in Amazon with only the bastion exposed to the Internet.

I'm using the following rule on the bastion (I've left out the source IP until I get it working):

iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 2222 -j DNAT --to 10.3.3.3:22

but when I try to connect, I get no response.

Running tcpdump on the bastion shows that traffic is getting through, so I assume I'm hitting the app server's VPC security groups and not getting as far as port 22 on it. I think this is happening because while the the bastion has permission to access port 22 on the app server, IP 1.2.3.4 doesn't.

So, my question is: Does NAT-ing the way I've set it up automatically change the source IP of packets so they appear to come from the bastion, or will they contain the original source IP, in this case 1.2.3.4?

If packets do contain 1.2.3.4 as the source IP after forwarding them, how can I change the source address to be the bastion's?

Update

I guess specifically for SSH I could set up SSH tunnelling, but I also need a similar solution to allow access to port 443 on several different app servers.

I've now tried adding SNAT as well with:

iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 10.2.2.2

but it still doesn't work (10.2.2.2 is the internal IP of the bastion).

share|improve this question

3 Answers 3

up vote 2 down vote accepted

So, my question is: Does NAT-ing the way I've set it up automatically change the source IP of packets so they appear to come from the bastion, or will they contain the original source IP, in this case 1.2.3.4?

No, DNAT doesn't change source ip, only destination. DNAT - Destination Network Address Translation

How would I know if IP forwarding was enabled on the bastion?

The following command should return 1

# cat /proc/sys/net/ipv4/ip_forward

And how can I make iptables perform SNAT (if that's in fact what I want - I want all traffic inside the VPC to appear to come from the bastion, and for the bastion to then redirect it back out appropriately)?

# iptables -t nat -I POSTROUTING -p tcp -s 1.2.3.4 -d 5.5.5.5 --dport 2222 -j DNAT --to-destination 10.3.3.3:22
share|improve this answer
    
How would I know if IP forwarding was enabled on the bastion? –  Drew J Aug 14 '13 at 12:18
    
And how can I make iptables perform SNAT (if that's in fact what I want - I want all traffic inside the VPC to appear to come from the bastion, and for the bastion to then redirect it back out appropriately)? –  Drew J Aug 14 '13 at 12:29

You have configured DNAT, or "destination NAT", which means that your gateway is rewriting the destination address of connections matching that rule. The source address remains the same, as you should be able to tell if you run tcpdump on the outbound interface of your bastion host or on your app server.

This means that the app server is attempting to return packets to the address of your origin host, 1.2.3.4 in your example. Whether or not this will work depends on how your hosts are all connected.

A simple solution would be to replace your iptables rule with a simple tcp proxy (e.g., haproxy, pen, balance, etc). Have the proxy listen on port 2222 on your bastion host and forward connections to port 22 on the app server and it will just work, because from the perspective of the app server connections originate on the bastion host.

share|improve this answer
    
I thought that could have been a possibility. The app server has no direct outbound connectivity. This is just a quick fix/short term solution so I don't really want a proxy. Is there anyway to achieve this only with iptables? –  Drew J Aug 14 '13 at 12:16

This is just a quick fix/short term solution

Then how about an SSH tunnel?

ssh -L 2222:10.3.3.3:22 username@5.5.5.5 -N &
#then
ssh username@localhost -p 2222

SSH over SSH :D

Just a thought.

Update: Didn't see that :-/ : "Update I guess specifically for SSH I could set up SSH tunnelling, but I also need a similar solution to allow access to port 443 on several different app servers."

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.