I have a network scenario where double NAT-forwarding is happening.
Public Firewall and Internal Firewall are doing NAT forwarding. I have only control of the Internal Firewall.
Client: X.X.X.X
Public Firewall: 10.10.10.1
Internal Firewall: 192.168.1.10
SSH server: 192.168.1.20
Public Firewall: Forwards all ports to Internal Firewall
Internal Firewall: Configured to forward port 22 to SSH Server
My problem is when Client connects to port 22 through the Public Firewall i see the ip of the Internal Firewall (192.168.1.10) on the SSH server instead of the Client's IP
This is how iptables are configured on the Internal Firewall:
iptables -A PREROUTING -t nat -p tcp -d 192.168.1.10 --dport 22 -j DNAT --to-destination 192.168.1.20:22
iptables -A POSTROUTING -t nat -p tcp -d 192.168.1.20 --dport 22 -j SNAT --to-source 192.168.1.10
Is there a way of preserving the Client's IP when it reaches SSH server ?