1

Short story, I want to expose SSH from a box in a NATed environment to the internet but would prefer to do it on a high (in the ephemeral range) port. Is it safe to port forward an ephemeral port to the internal network or could it cause problems with the NAT table for outgoing traffic? In other words, if I define a DSTNAT (port forwarding) rule on my Mikrotik in the ephemeral range will it then exclude it from being used for SRCNAT?

1 Answer 1

2
  1. It's not an "ephemeral port" unless it's a randomly chosen port for a connection. You're talking about plain high port numbers, or unreserved ports, anything starting with 1025 and over.

  2. Yes, this is fine so long as you've got the rest of your security in order. I run SSH on port 2222 to cut way down on script kiddies blowing up my logs with failed login attempts.

    There is one notable potential issue: If someone has non-root access to your server, granted or via some other vulnerability, and they can manage to crash your SSH server, they could run their own SSH server because that port is allowed for non-root programs. If you SSH'd into their SSH daemon and did a su or sudo they could grab the password and do all kinds of fun thing.

2
  • Nice point about the port not being a root-only port and hence the packet filter rule being a potential vector to elevate privilege in the long run. +1 Sep 11, 2014 at 15:38
  • Thanks for pointing out number 1. Something I know in theory but obviously not in practice. In terms of 2., I'm the only one with login access to the box, it's a gitlab server so users ssh with git@{server} to push and pull code. They'd have to get command execution through gitlab and then crash SSH, plus they're employees :) But thanks for pointing that out, never considered that! Sep 11, 2014 at 15:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .