I want to access via SSH a DB server from an outside network via a linux (CentOS) gateway with two interfaces in separate networks as it follow below:

Admin PC IP:

Linux GW IP eth1 Outside: - SSH Port 10051

Linux GW IP eth2 Inside:

DB Server IP: - SSH Port 22

FLOW: --> eth1: --> eth2: -->

and the return path --> eth2: --> -->

The iptables rules that i tried seems to be wrong.. Something similar with :

iptables -t mangle -A PREROUTING -d <Server1_eth0> -p tcp --dport 2223 -j MARK --set-mark 1 -i eth0

iptables -t nat -A PREROUTING -p tcp -m mark --mark 1 -j DNAT --to-destination <Server2>:2222 -i eth0

iptables -t nat -A POSTROUTING -m mark  --mark 1 -j SNAT --to-source <Server1_eth1> -o eth1 

iptables -A FORWARD -m mark --mark 1 -j ACCEPT -o eth1

Need some hint..thx..

2 Answers 2


Depending on your needs and network configuration there are different solutions.

If your DB server has a routing path towards the Admin PC, you just need this NAT rule on your gw:

iptables -t nat -A PREROUTING -i eth1 -s -p tcp --dport 2222 -j DNAT --to

and then just ssh into the gw port.

If your DB server doesn't have a gateway to 10.21 network, with this NAT rule, you can "hide" the Admin PC address behind the gw IP:

iptables -t nat -A POSTROUTING -o eth2 -s -p tcp -d --dport 22 -j SNAT --to

If you have ssh access to both servers and all you want is just a terminal you may enter in the DB server by cascading ssh like this:

ssh -t -l gwuser -p 10051 ssh -l dbuser -p 22

iptables -A FORWARD -d $dst_ip -i eth2 -p tcp -m tcp --dport 10022 -j ACCEPT

iptables -t nat -A PREROUTING -d $src_ip -p tcp -m tcp --dport 10022 -j DNAT --to-destination $dst_ip

iptables -t nat -A POSTROUTING -o eth2 -j MASQUERADE

And.. solved thx.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.