Re: iptables - dynamic ip - port forward ssh to internal box
Well what i was doing is completely doing ACCEPT as
default rules just for testing purposes.
and i found out that THIS did work
iptables -t nat -A PREROUTING -d EXTIP -p tcp --dport
22 -j DNAT --to 192.168.1.8:22
but then for some reason any other port for the
--dport wasnt working. Then for shits n giggles, i
tried it as port 80.
And guess what it worked, so then i concluded, that
where i was testing it from, my work, blocks most
outgoing ports :) Took me about 6+ hours into my
work day before i figured that out :(
--- funky soul <email@example.com> wrote:
> hi Paul,
> On Wed, 30 Apr 2003 09:52:18 -0700 (PDT)
> Paul <firstname.lastname@example.org> wrote:
> > I have 2 linux boxes, and 2 windows boxes. One
> > box will be the firewall/gateway, internet on eth0
> > internal lan on eth1. What im looking for is
> > suggestions on my script, and also needing to know
> > i can lets say have all external connections that
> > to connect to me on port 10022 be forwarded to
> > 192.168.1.8:22, so that i can be able to ssh into
> > of my linux boxes, the firewall one, and an
> > one. Ive had 0 luck with adding stuff into
> > to get it working, after looking at many scripts.
> the linux ip masq howto sure did answer my questions
> about this
> i *think* you'll have to use different ports (at the
> at least) for ssh logins into different hosts.
> > currently have rinetd running with it, which will
> > allow me to connect via 10022 within my internal
> > network and it does forward it correctly, but by
> > an external connection to port 10022, it cant
> > at all, and yes i did open port 10022 on my INPUT,
> > script below doesnt include that since im in
> > phase, but id prefer to get it working w/o rinetd.
> INPUT is applied when a packet arrives in to the
> firewalling host.
> what you want is 'FORWARD' to forward packets
> comming in on one port
> (let's say port 10022) and pass it to another port
> (e.g. port 22 on
> which sshd listens per default) on another host.
> i use something like
> $IPTABLES -A FORWARD -i $EXTIF -o $INTIF -p tcp
> --dport 22 -m state --state \
> NEW,ESTABLISHED,RELATED -j ACCEPT
> $IPTABLES -A PREROUTING -t nat-p tcp -d$EXTIP
> --dport 22 -j DNAT \
> lemme know if this helps or especially if i'm wrong
> f. soul
> , ,
> / \ GNU's not Unix
> `-_---' `---_-' Funky Soul
> `--|o` 'o|--'
> \ ` / funkysoul@
> ): :( swissonline.ch
> ATTACHMENT part 2 application/pgp-signature
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.