1

I'm on an ubuntu vserver and want to port forward clients to a host who's connected via ssh, and has putty configured to remotely port forward the port 1802.

What I want to accomplish: I want my vserver to act as a proxy for a given port for an application. I want to be able to connect to my vserver using that port, but be redirected to the reverse proxy (host):

Client A <== x.x.x.x:1802 ==> vserver (port forward) <== reverse proxy / ssh connection ==> Host

What I already have: The host already has a remote port forwarding using putty and a ssh connection to my vserver. All I'm missing is the port forwarding, so that Client that connect to the vserver using the specified ports are DNAT'ed to the Host.

This is what I tried so far: I tried adding listen 1802; in my nginx server config, but that didn't work at all (I think I was missing the proxy_pass config). Then I tried using iptables:

iptables -t nat -A PREROUTING -i -p udp --dport 1802 -j DNAT --to-destination 127.0.0.1:1802
iptables -t nat -A PREROUTING -i -p tcp --dport 1802 -j DNAT --to-destination 127.0.0.1:1802
iptables-save

But I'm unsure about the --to-destination parameter. Also, I omitted the -i value, so that all interfaces are used for the iptables entry.

1
  • I'm pretty sure you need both a PREROUTING and POSTROUTING flag. Additionally, the nginx proxy pass would work for this in TCP stream mode only.
    – Andrew
    Feb 27, 2018 at 15:28

1 Answer 1

0

In my case, adding GatewayPorts yes to /etc/ssh/sshd_config was needed. Restarting ssh didn't suffice, I had to restart the vserver - then it worked. I didn't even need any special iptables entries, cause all ports were on ACCEPT already.

1
  • 1
    Restarting sshd doesn't touch existing sessions. Those sessions run with the old config until they logout.
    – kubanczyk
    Mar 2, 2018 at 17:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .