1

I do find a lot of information of how to limit incoming access to certain IP addresses, but not do do it on the other side, the outbound side. When i have a SOCKS 5 Proxy. I'm primary looking for a way to do it in openssh (ssh_config) but if not possible then with IP-Tables.

2
  • Do you want normal (not proxied) traffic from the proxy machine to be able reach all IP addresses? i.e. Do you only want to filter the proxied traffic?
    – hardillb
    Nov 30, 2020 at 9:08
  • Yes , preferably filter on SSH user-level. No interference with non SSH-User traffic. Also the possibility to have different filter for different users would be appreciated .
    – Kaffeburk
    Nov 30, 2020 at 11:10

2 Answers 2

1

Assuming standard OpenSSH server I've been through the docs and the closest looks to be the PermitOpen option.

 PermitOpen
         Specifies the destinations to which TCP port forwarding is per‐
         mitted.  The forwarding specification must be one of the fol‐
         lowing forms:

               PermitOpen host:port
               PermitOpen IPv4_addr:port
               PermitOpen [IPv6_addr]:port

         Multiple forwards may be specified by separating them with
         whitespace.  An argument of any can be used to remove all re‐
         strictions and permit any forwarding requests.  An argument of
         none can be used to prohibit all forwarding requests.  The
         wildcard ‘*’ can be used for host or port to allow all hosts or
         ports respectively.  Otherwise, no pattern matching or address
         lookups are performed on supplied names.  By default all port
         forwarding requests are permitted.

To restrict the forwarding for only certain users, you could use something like

Match User user1 ...
PermitOpen ...

Trying to do this with iptables isn't going to give you the control you want as all traffic will look to originate from the openssh server process and from the proxy machine with no way to identify which user had requested it.

0

I did find another answer, at least how to do it in NFTable. This limit ssh user user1 to one public IP, but more can be added. Not allowed calls will be logged in syslog (/var/log/syslog)

nft add rule ip filter OUTPUT  meta skuid user1 ip daddr  <public Ip of server> tcp dport 80  accept
nft add rule ip filter OUTPUT  meta skuid user1 ip daddr  <public Ip somwhere> tcp dport 80  accept
nft add rule ip filter OUTPUT  meta skuid user1 ip daddr  <public Ip of server> tcp dport 443  accept
nft add rule ip filter OUTPUT  meta skuid user1 ip daddr  <public Ip somwhere> tcp dport 443  accept
nft add rule ip filter OUTPUT  meta skuid user1 tcp dport 80 log prefix \"Not allowed  call at port 80 \" drop
nft add rule ip filter OUTPUT meta skuid user1 tcp dport 443 log prefix \"Not allowed call at port 443 \" drop

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.