Ssh – How to forward the HTTP and SSH port to the internal server using iptables

httpiptablesport-forwardingroutingssh

I do not have the router so I made my CentOS 6.4 Linux system into a router, forwarding the public network traffic to my local LAN.
It has two NIC cards, one for the public IP address (eth1) and another for the private IP address (eth2).

I have a server connected to my local LAN, let's say at 192.168.1.2.

Router

  • eth1: x.x.x.x, the public IP address
  • eth2: 192.168.1.1, the internal router address

When someone from an outside network runs ssh on the public IP, it should be redirected to the server:

ssh x.x.x.x or using PuTTY

I disabled the SELinux and iptables firewall on the server.
I tried some iptables modifications on the Linux system router, but the SSH request is still not redirected:

iptables -t nat -A PREROUTING -p tcp -d 192.168.1.1 --dport 22 -j DNAT --to-destination 192.168.1.2:22

I also want to forward all HTTP (80) traffic to my internal server using iptables from the same Linux system router.

Best Answer

First of all make sure the packet forwarding is enabled in the kernel

# echo 1 > /proc/sys/net/ipv4/ip_forward

You can also make it permanent by adding below line to /etc/sysctl.conf

net.ipv4.ip_forward = 1

You have to do this on Linux Machine acting as a router. You can try the following rule on router machine.

iptables -t nat -A PREROUTING -i eth1 -d x.x.x.x -p tcp --dport 22 -j  DNAT --to-destination 192.168.1.2:22

Also let us know the output of your NAT Rules from the router box.

iptables -t nat -L -n -v
Related Topic