Hi,
I have the following situation:
From a server (<webserver>) on the internet, I want to connect to a SQL Server database on an internal windows server (call it <dbserver>), via a linux server (call it <myserver>), both of which are inside a firewall.
My plan is this:
1. Set up port 1433 on <myserver> to forward to <dbserver>. I have done this by adding the following in iptables:
iptables -I INPUT 1 -p tcp --dport 1433 -i eth0 -j ACCEPT
iptables -t nat -I PREROUTING -p tcp --dport 1433 -i eth0 -j DNAT --to <dbserver>:1110
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o eth0 -j SNAT --to-source <myserver>
This seems to work -from an internal machine, if I do
telnet <myserver> 1433, i get a response from SQL Server on <dbserver>
2. Set up a remote ssh tunnel to <webserver> from <myserver>
I have done this using the command:
ssh -f -SgR1433:localhost:1433 <webserver>
When I test, on <webserver> I get the following:
[xxx@webserver]$ telnet localhost 1433
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Connection closed by foreign host.
--------------------
I tried setting up the tunnel directly on the windows server <dbserver> instead, and it all works fine - when I do as above I get the same output, but without the line "Connection closed by foreign host.".
So the tunnel seems to work if I have it on <dbserver>, but if I have it on <myserver> and then use iptables to forward port 1433, it disconnects. I know it is getting as far as <myserver> because if I set up the tunnel with verbose output I get (on <myserver>):
debug: Ssh2ChannelTcpFwd/sshchtcp
fwd.c:524/
ssh_channe
l_ftcp_ope
n_request:
open request for remote forwarded TCP/IP channel
debug: Received remote TCP/IP forward connect for port 1433 from 127.0.0.1:34674
warning: Connecting to localhost:1433 failed (remote forward, port 1433)
It is not a problem with the firewall on <webserver> as I have tried with that stopped.
I guess it must be a problem with how I have set up the port forwarding, but it works if you connect to the port directly rather than through the tunnel.
Any suggestions?? Thanks.
Start Free Trial
