SSH redirected to a different ip address after adding new iptables

Question

I have some troubles to reach by SSH my dedicated server running on Proxmox hypervisor with the following ip address 40.53.XX.XX.

There is my configuration:

I have 3 VM’s running on it with a local ip address:

Vm1 has the ip address 192.168.4.4 and run a website (with Apache ) that has the domain name "london.austria.com"

Vm2 has the ip address 192.168.4.5 and run a website (with Apache ) that has the domain name "manchester.austria.com"

With that configuration, I have no problem to reach all the VM’s and the hypervisor by SSH.

Today, I set up a Nginx reverse proxy in order to reach the websites on the VM1 and VM2 from the internet.

Let’s call this Nginx reverse proxy VM3 and it has the local ip address 192.168.4.2

The set up is working fine. I can reach the website running on VM1 And VM2.

But now, after I added the new iptables rules in the 2 last lines in /etc/network/interfaces to my hypervisor on 40.53.XX.XX, I receive a message saying the server fingerprint has changed…Do you want to connect?

If I click yes, I’m connected to the Nginx Reverse proxy (192.168.4.2), not the hypervisor (40.53.XX.XX.).

I tried another SSH tool but the problem is the same.

There is below the /etc/network/interfaces on the hypervisor:

root@ns568745:~# cat /etc/network/interfaces
    # This file describes the network interfaces available on your system
    # and how to activate them. For more information, see interfaces(5).

    # The loopback network interface
    auto lo
    iface lo inet loopback


    # vmbr0: Bridging. Make sure to use only MAC adresses that were assigned to you.
    auto vmbr0
    iface vmbr0 inet static
        address 40.53.XX.XX /24
        gateway 40.53.XX.XX .254
        bridge_ports eno1
        bridge_stp off
        bridge_fd 0





    auto vmbr1
    iface vmbr1 inet static
        address  192.168.4.254/24
        broadcast 192.168.4.255
        bridge_ports none
        bridge_stp off
        bridge_fd 0
        post-up echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up iptables -t nat -A POSTROUTING -s '192.168.4.254/24' -o vmbr0 -j MASQUERADE
        post-down iptables -t nat -D POSTROUTING -s '192.168.4.254/24' -o vmbr0 -j MASQUERADE


post-up iptables -t nat -A PREROUTING -d 40.53.XX.XX -p tcp -m multiport --dports 80,443 -m comment --comment "nginx" -j DNAT --to-destination 192.168.4.2

post-up iptables -t nat -A POSTROUTING -s 192.168.4.0/24 -j SNAT --to-source 40.53.XX.XX

and the Nginx config file in /etc/nginx/sites-available ( ip address: 192.168.4.2)

server {
    listen 80 default;
    listen [::]:80 default;
    server_name manchester.example.com;

    location / {
        proxy_pass http://192.168.4.5:80;
    }
}

server {
    listen 80;
    listen [::]:80;
    server_name london.example.com;

    location / {
        proxy_pass http://192.168.4.4:80;
    }
}

Why am I redirected to 192.168.4.2 when I want to connect to 40.53.XX.XX and how can I connect by SSH to 40.53.XX.XX ?

Edit 1 :

Output of iptables-save after enabling the 2 iptables rules in the 2 last lines in /etc/network/interface

root@ns568745:~# iptables-save
# Generated by iptables-save v1.6.0 on Sun Feb  9 16:01:44 2020
*filter
:INPUT ACCEPT [640:213744]
:FORWARD ACCEPT [15:900]
:OUTPUT ACCEPT [495:208357]
COMMIT
# Completed on Sun Feb  9 16:01:44 2020
# Generated by iptables-save v1.6.0 on Sun Feb  9 16:01:44 2020
*nat
:PREROUTING ACCEPT [82:4115]
:INPUT ACCEPT [68:2699]
:OUTPUT ACCEPT [27:1694]
:POSTROUTING ACCEPT [34:2114]
-A PREROUTING -d 40.53.XX.XX/32 -p tcp -m multiport --dports 80,443,22 -m comment --comment nginx -j DNAT --to-destination 192.168.4.2
-A POSTROUTING -s 192.168.4.0/24 -o vmbr0 -j MASQUERADE
-A POSTROUTING -s 192.168.4.0/24 -j SNAT --to-source 40.53.XX.XX
COMMIT
# Completed on Sun Feb  9 16:01:44 2020

Output of iptables-save when disabling the 2 iptables rules in the 2 last lines in /etc/network/interface

root@ns568745:~# iptables-save
# Generated by iptables-save v1.6.0 on Sun Feb  9 15:56:26 2020
*filter
:INPUT ACCEPT [75392:20174610]
:FORWARD ACCEPT [34704:41945853]
:OUTPUT ACCEPT [70877:23709671]
COMMIT
# Completed on Sun Feb  9 15:56:26 2020
# Generated by iptables-save v1.6.0 on Sun Feb  9 15:56:26 2020
*nat
:PREROUTING ACCEPT [15399:828377]
:INPUT ACCEPT [11207:472538]
:OUTPUT ACCEPT [428:27752]
:POSTROUTING ACCEPT [591:34272]
-A POSTROUTING -s 192.168.4.0/24 -o vmbr0 -j MASQUERADE
COMMIT
# Completed on Sun Feb  9 15:56:26 2020

Answer 1

The problem is this line:

-A PREROUTING -d 40.53.XX.XX/32 -p tcp -m multiport --dports 80,443,22 -m comment --comment nginx -j DNAT --to-destination 192.168.4.2

This rule forward http (80), https (443) and ssh (22) to 192.168.4.2 host.

Since your original interfaces command does not have port 22 included, port 22 must be added somewhere else to the DNAT rule.