Iptables – Forwarding Port to SSH on Different Network Machine

forwardingsshUbuntu

I have a Ubuntu PC, with two networks cards, acting as a router. One card eth0 is connected to internet and other eth1 is connected to LAN.
I want to expose ssh ports of different hosts in LAN to different port numbers to outside world. i.e.
"ssh user@router -p 1234" should go to ssh port of host1 and "ssh user@router -p 3456" should ssh to host2.
I added following iptable rule for host1 but it doesn't work:

iptables -A FORWARD -i $EXTIF -o $INTIF -p tcp --dport 1234 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A PREROUTING -t nat -p tcp -d $EXTIP --dport 1234 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j DNAT --to-destination 10.9.0.2:22

EXTIF is external inteface (eth0),
INTIF is internal interface (eth1),
EXTIP Is IP address of eth0.

Any help?
(Not sure if question is clear, please edit with right jargon if somebody understands my intent)

Best Answer

The rule for the FORWARD chain needs to use the target port, because it is executed after the prerouting chain, i.e. after the DNAT has been done.

iptables -A FORWARD -i $EXTIF -o $INTIF -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT

A good overview diagram of how the various tables and chains are linked together is here: http://www.csie.ntu.edu.tw/~b92035/cnl/hw1/Iptables.gif

Related Solutions

Ssh – iptables rules to block ssh remote forwarded ports

Would it not be easier to switch off ssh forwarding on the ssh server? Just change AllowTcpForwarding from yes to no in your /etc/ssh/sshd_config. If this doesn't suit, you could try something along the lines of

iptables -A OUTPUT -o eth1 -p tcp --cmd-owner "sshd" -j DROP

Ssh-agent forwarding and sudo to another user

As you mentioned, the environment variables are removed by sudo, for security reasons.

But fortunately sudo is quite configurable: you can tell it precisely which environment variables you want to keep thanks to the env_keep configuration option in /etc/sudoers.

For agent forwarding, you need to keep the SSH_AUTH_SOCK environment variable. To do so, simply edit your /etc/sudoers configuration file (always using visudo) and set the env_keep option to the appropriate users. If you want this option to be set for all users, use the Defaults line like this:

Defaults    env_keep+=SSH_AUTH_SOCK

man sudoers for more details.

You should now be able to do something like this (provided user1's public key is present in ~/.ssh/authorized_keys in user1@serverA and user2@serverB, and serverA's /etc/sudoers file is setup as indicated above):

user1@mymachine> eval `ssh-agent`  # starts ssh-agent
user1@mymachine> ssh-add           # add user1's key to agent (requires pwd)
user1@mymachine> ssh -A serverA    # no pwd required + agent forwarding activated
user1@serverA> sudo su - user2     # sudo keeps agent forwarding active :-)
user2@serverA> ssh serverB         # goto user2@serverB w/o typing pwd again...
user2@serverB>                     # ...because forwarding still works

Best Answer

Related Solutions

Ssh – iptables rules to block ssh remote forwarded ports

Ssh-agent forwarding and sudo to another user

Related Topic