• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 335
  • Last Modified:

iptables question

Hello everybody!
I have a linux firewall (192.168.0.1) and I would like to forward all the incoming ssh connection from LAN directed to FIREWALL IP (1.2.3.4) to a LAN machine (192.168.0.10).

Do you think it is possible? How can I do it?
0
phoenix128
Asked:
phoenix128
1 Solution
 
Todd MummertCommented:

It's been a while...

change to use the correct interface:

iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 22 -j DNAT --to 192.168.0.10:22
iptables -A INPUT -p tcp -m state --state NEW --dport 22 -i eth1 -j ACCEPT
0
 
phoenix128Author Commented:
It is not soe easy :)
I also need to masquerade the packet to let the internal machine believe it is coming from the firewall's IP.

The problem is that I already tried to do it with DNAT and MAQUERADE or SNAT... the packet is sent to the destination's machine but it does not come back.

Any idea?
0
 
diepesCommented:
1. I assume you can ping the ip's from the fw ? (Connectivity ok)
2. What is your interface names ?  eth0-192.168.0.1   eth1-1.2.3.4
3. Subnet mask's ?

from climbgunks:
iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 22 -j DNAT  --to-destination192.168.0.10:22

iptables -A POSTROUTING -t nat -o eth0 -p tcp --dport 22 -j SNAT --to-source 192.168.0.1

iptables -A FORWARD -p tcp --dport 22 -d 192.168.0.10

The last rule you can make more specific if you know where the ssh will come from.
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now