0

Scenario :

I have to host a Webserver/SSH server at "Server B" which is without public IP,

I purchased a VPS "Server A" with a public IP and I am doing reverse SSH port forwarding as

Internet -->  22 : "Server A" --> 22  : Server B
Internet --> 443 : "Server A" --> 443 : Server B

So accessing "Server A" at port 22 forwards to "Server B" at port 22 as expected

Problem:

I cant see the source IP accessed at "Server B" , I just see the source IP as localhost, Due to regular brute forcing attacks at SSH , I need fail2ban at "server B' but that has been useless because of no source IP.

I cannot change the port from 22 to something else.

I have tried VPN from "Server B" to "Server A" but I couldn't setup the iptables rules at "Server A" to forward a specific port from "Server A" to "Server B".

What could I do best so that I can get the source IP at "Server B" ?

Thanks.

  • So server A and server B are in the same network? If server B does not have a public IP then all the SSH connections must be coming from the local network not the internet. And if someone if port forwarding to server B from server A over the internet you need fail2ban on server A instead of B – Farhan.K Oct 13 '20 at 10:33
1
Server-A = Private IP 192.168.1.1 with Public IP 1.2.3.4 (has direct internet access)
Server-B = 192.168.1.2 (no direct internet access)
Client-PC = Public IP 5.6.7.8  (router's ISP address)

You must get rid of SSH Tunneling in order to achieve your goal. When Client-PC attempts to connect to Server-A, it must be redirected to Server-B on TCP 22. From Server-B perspective, SSH traffic is coming from 5.6.7.8

On the host that is acting as a Linux gateway (Server-A in this case), do the following:

$ sudo echo "1" > /proc/sys/net/ipv4/ip_forward
$ sudo iptables -t nat -A PREROUTING -p tcp -m tcp -d 1.2.3.4 --dport 22 -j DNAT --to-destination 192.168.1.2:22
$ sudo iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

From Server-B, make sure it knows how to send return traffic back to 5.6.7.8

If not, then add a static route on Server-B

$ sudo ip route add default via 192.168.1.1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.