1

I need to access a Linux box via SSH & Samba that is hidden/connected behind another one.

Setup :-

  
 A        switch    B         C
|----|    |---|    |----|    |----|
|eth0|----|   |----|eth0|    |    |
|----|    |---|    |eth1|----|eth1|
                   |----|    |----|

Eg, SSH/Samba from A to C

How does one go about this?
I was thinking that it cannot be done via IP alone? Or can it?

Could B say "hi on eth0, if your looking for 192.168.0.2, its here on eth1"?
Is this NAT? This is a large private network, so what about if another PC has that IP?!

More likely it would be PAT?
A would say "hi 192.168.109.15:1234"
B would say "hi on eth0, traffic for port 1234 goes on here eth1"
How could that be done?

And would the SSH/Samba demons see the correct packet header info and work??

IP info :-

A - eth0 - 192.168.109.2
B - eth0 - B1 = 192.168.109.15 B2 = 172.24.40.130
  - eth1 - 192.168.0.1
C - eth1 - 192.168.0.2

A, B & C are RHEL (RedHat) But Windows computers can be connected to the switch. I configured the 192.168.0.* IPs, they are changeable.


Update after response from Eddie

Few problems (and Machines' B IP is different!)

From A :-
ssh 172.24.40.130 works ok, (can get to B2)
but ssh 172.24.40.130 -p 2022 -vv times out with :-

OpenSSH_4.3p2, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to 172.24.40.130 [172.24.40.130] port 2022.
...wait ages...
debug1: connect to address 172.24.40.130 port 2022: Connection timed out
ssh: connect to host 172.24.40.130 port 2022: Connection timed out

From B2 :-

$ service iptables status
Table: filter
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination
1    ACCEPT     tcp  --  0.0.0.0/0            192.168.0.2         tcp dpt:22

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

Table: nat
Chain PREROUTING (policy ACCEPT)
num  target     prot opt source               destination
1    DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:2022 to:192.168.0.2:22

Chain POSTROUTING (policy ACCEPT)
num  target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

And ssh from B2 to C works fine :-

$ ssh 192.168.0.2

Route info :-

$ route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.0.0     *               255.255.255.0   U     0      0        0 eth1
172.24.40.0     *               255.255.255.0   U     0      0        0 eth0
169.254.0.0     *               255.255.0.0     U     0      0        0 eth1
default         172.24.40.1     0.0.0.0         UG    0      0        0 eth0

$ ip route  
192.168.0.0/24 dev eth1  proto kernel  scope link  src 192.168.0.1
172.24.40.0/24 dev eth0  proto kernel  scope link  src 172.24.40.130
169.254.0.0/16 dev eth1  scope link
default via 172.24.40.1 dev eth0

So I just dont know why the port forward doesnt work from A to B2?

3 Answers 3

1

What you have termed PAT would work. You will need to have iptables running(or some customizable firewall). Then run the following commands:

iptables -t nat -A PREROUTING -p tcp --dport 22 -p DNAT --to-destination 192.168.0.2
iptables -t nat -A PREROUTING -p tcp --dport 135:139 -p DNAT --to-destination 192.168.0.2
iptables -t nat -A PREROUTING -p tcp --dport 445 -p DNAT --to-destination 192.168.0.2
service iptables save
echo 1 > /proc/sys/net/ipv4/ip_forward

In the file /etc/sysctl.conf, change the line:

net.ipv4.ip_forward = 0

to

net.ipv4.ip_forward = 1
1

For SSH

On B:

#Arbitrary port
SOME_PORT=2022
iptables -t nat -I PREROUTING -p tcp --dport $SOME_PORT -j DNAT --to-destination 192.168.0.2:22
iptables -I FORWARD -p tcp --dport 22 -d 192.168.0.2 -j ACCEPT
#On a machine type A:
ssh -p $SOME_PORT

For Samba

Is it possible to mount C shares via nfs on B then setup samba on B? If not, then you can redirect the samba ports:

iptables -t nat -I PREROUTING -p tcp -m multiport –dports 139,445 -j DNAT --to-destination 192.168.0.2
iptables -t nat -I PREROUTING -p udp –dport 137:138 -j DNAT --to-destination 192.168.0.2

If samba is already running on B, then you could bind an additional IP address on B and forward to C (you could do this for ssh also to keep port 22. Be wary of services starting on the 0.0.0.0 address):

ifconfig eth0:1 192.168.109.16 netmask 255.255.255.0

iptables -t nat -I PREROUTING -d 192.168.15.109.16 -p tcp --dport 22 -j DNAT --to-destination 192.168.0.2
iptables -t nat -I PREROUTING -d 192.168.15.109.16 -p tcp -m multiport –dports 139,445 -j DNAT --to-destination 192.168.0.2
iptables -t nat -I PREROUTING -d 192.168.15.109.16 -p udp –dport 137:138 -j DNAT --to-destination 192.168.0.2

EDIT I see you're still having problems; make sure that:

  • Machine B has ip forwarding enabled : echo 1 > /proc/sys/net/ipv4/ip_forward
  • Machine C has a route back to the user via machine B. If not, then set a masquerade rule on machine B :

    iptables -t nat -I POSTROUTING -d 192.168.0.2 -p tcp --dport 22 -j MASQUERADE

tcpdump can be useful to troubleshoot. On machine B:

#capture and display packets heading to 192.168.0.2
tcpdump -i any -p tcp ip host 192.168.0.2 and port 22
1
  • small note just for ref : "ssh -p $SOME_PORT" => "ssh <B_ip_addr> -p $SOME_PORT"
    – IanVaughan
    Apr 29, 2010 at 15:50
0

Hmmm. Well, assuming that the switch always routes traffic to machine B, you can just do:

route add -net 192.168.0.0 netmask 255.255.255.0 dev eth1

That should tell machine B that, if traffic comes in for the 192.168.0.0/24, send it out eth1.

That should work, and it's a bit easier than setting up a NAT. You'll need to make sure the switch knows to route traffic for 192.168.0.0/24 to 192.168.109.15 (Eth 0 on B).

@Ian: Routing isn't necessarily easy, but it's not that hard either. That's what routers do. Assuming your switch is just a switch, with no routing capability, you can't use it to set the route, but you have to have a router somewhere or your network is purely a local LAN with no internet access.

Check your machines, and find out where the default gateway is (on the linux boxes you can just type route with no arguments. Your default gateway route is the one that looks like:

default         192.168.1.1      0.0.0.0         UG    0      0        0 eth0

That's your "core" router. that's the machine all the machines look to to figure out where machines on other subnets are. That's where you need to add a route pointing to the B machine as the gateway router for the 192.168.0.0/24 subnet.

If you can give me some information on your router, I can tell you how to add that route.

2
  • That's a nice idea, but I have simplified the network diagram, there are many machines like A, and some have many hops, but they can all access B-eth0 ok. As you state, getting traffic for 192.168.0.0/24 to KNOW to goto 192.168.109.15 would be hard?! So this makes this solution not workable. Thanks.
    – IanVaughan
    Apr 29, 2010 at 13:43
  • Thanks again, excellent idea, and your right, that would work! IF... I was allowed to change the main router. But I am within a company network, and thus cannot do that! (I have had them set routing for my subnet, 192.168.109.0/24 -> 172.24.150.50, but I was pushing my luck getting that!) Any anyway, I am actually after a different solution for transparency and portability. So again, many thanks...
    – IanVaughan
    Apr 29, 2010 at 16:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .