martians and portforwarding to 127.0.0.1

martians and portforwarding to 127.0.0.1

[udo]

Hello,

To be able to run sshd from an unpriviliged port I
want to let sshd listen to just the lo (12.0.0.1)
interface, port 2222 and forward connections to port
22 on my internet and LAN interfaces to 127.0.0.1:22.
To enable this I use something like:

$path_iptables -t nat -A PREROUTING -p tcp -i $ext_if
-s 0/0 -d $ext_ip --dport 222 -j DNAT --to
127.0.0.1:22
$path_iptables -t nat -A PREROUTING -p tcp -i
$local_if -s $local_net -d $local_ip --dport 222 -j
DNAT --to 127.0.0.1:22

$path_iptables -A FORWARD -p tcp -i $ext_if -o lo  -s
0/0 -d 127.0.0.1 --dport 22 -m state --state NEW -j
ACCEPT
$path_iptables -A FORWARD -p tcp -i $local_if -o lo -s
$local_net -d 127.0.0.1 --dport 22 -m state --state
NEW -j ACCEPT

(for a test I enabled port 222 -> 127.0.0.1:22)

This makes the following message appear in the log:

blabla kernel: martian destination 127.0.0.1 from
x.y.z.q, dev ppp0

How can I make the sshd (attached to loopback) work
without `martian destination` messages for packets
destined for port 22?
Please post!

Kind regards,
Udo


	
		
__________________________________
Do you Yahoo!?
Yahoo! Photos: High-quality 4x6 digital prints for 25¢
http://photos.yahoo.com/ph/print_splash

hello german speaking?

[marc manthey]

hallo

kennst sich hier jemand  mit CUSEEME  aus oder hat schon mal einer 
einen REFLECTOR
server aufgesetzt oder kennt  die  problematik  mit den ports?

wäre  sehr  dankbar

gruss

aus köln

--

          Marc Manthey (C.V.O.)
          Hildeboldplatz 1a
          D – 50672 KÖLN
          web:http://www.let.de
          mail:marc@electric-circus.de
          Mobile:+49(0)177-3415481
--

Re: martians and portforwarding to 127.0.0.1

[David Cannings]

On Tuesday 20 April 2004 17:33, udo wrote:
> $path_iptables -t nat -A PREROUTING -p tcp -i $ext_if
> -s 0/0 -d $ext_ip --dport 222 -j DNAT --to
> 127.0.0.1:22
> How can I make the sshd (attached to loopback) work
> without `martian destination` messages for packets
> destined for port 22?

Please see my lengthly post about this from last month.  Due to the way 
the martian checking code in the kernel is written, I do not think this 
is possible.

http://lists.netfilter.org/pipermail/netfilter/2004-March/051615.html

Hopefully somebody can prove this wrong, I hope that post helps you.

David

Re: hello german speaking?

[Antony Stone]

On Tuesday 20 April 2004 5:42 pm, marc manthey wrote:

> hallo
>
> kennst sich hier jemand  mit CUSEEME  aus oder hat schon mal einer
> einen REFLECTOR
> server aufgesetzt oder kennt  die  problematik  mit den ports?

Ich kann ein bisschen Deutsch sprechen, ja, aber ich kann nicht mit CUSEEME 
hilfen :(

Vielleicht kann jemand anderes auf Englisch hilfen....

And now, in case anyone else can help this guy, he's asking whether anyone 
here knows how to set up a CUSEEME reflector, or whether there is some 
problem with the ports it uses (presumably in relation to netfilter rules, 
although he doesn't actually ask this).

I don't know the answer, I just thought a translation of the question might 
help to find someone who does?

Regards,

Antony.

-- 
It is also possible that putting the birds in a laboratory setting 
inadvertently renders them relatively incompetent.

 - Daniel C Dennet

                                                     Please reply to the list;
                                                           please don't CC me.

Re: martians and portforwarding to 127.0.0.1

[Antony Stone]

On Tuesday 20 April 2004 5:33 pm, udo wrote:

> Hello,
>
> To be able to run sshd from an unpriviliged port I
> want to let sshd listen to just the lo (12.0.0.1)
> interface, port 2222 and forward connections to port
> 22 on my internet and LAN interfaces to 127.0.0.1:22.

I find it hard to understand quite what you mean here.

1. Why would you want to use ssh to connect to the same machine (which is all 
you can do on the loopback interface)?

2. If you have sshd listening on port 2222, why not just ssh to port 2222?

3. You use the word "forward" in a way which confuses me - are you talking 
about one machine here, or redirecting the packets to some other machine on 
the Internet or your LAN?   (In which case, address 127.0.0.1 is probably not 
approporiate).

> To enable this I use something like:
>
> $path_iptables -t nat -A PREROUTING -p tcp -i $ext_if
> -s 0/0 -d $ext_ip --dport 222 -j DNAT --to
> 127.0.0.1:22
> $path_iptables -t nat -A PREROUTING -p tcp -i
> $local_if -s $local_net -d $local_ip --dport 222 -j
> DNAT --to 127.0.0.1:22

I think those rules need to be in the OUTPUT chain nat table.

> $path_iptables -A FORWARD -p tcp -i $ext_if -o lo  -s
> 0/0 -d 127.0.0.1 --dport 22 -m state --state NEW -j
> ACCEPT

Nothing is going to come in the $ext_if addressed to 127.0.0.1 and destined 
for interface lo.

Packets *to* lo come *from* lo.

> $path_iptables -A FORWARD -p tcp -i $local_if -o lo -s
> $local_net -d 127.0.0.1 --dport 22 -m state --state
> NEW -j ACCEPT
>
> (for a test I enabled port 222 -> 127.0.0.1:22)
>
> This makes the following message appear in the log:
>
> blabla kernel: martian destination 127.0.0.1 from
> x.y.z.q, dev ppp0

Yes.   The loopback address is not a valid destination address for packets 
coming from outside the machine.

> How can I make the sshd (attached to loopback) work
> without `martian destination` messages for packets
> destined for port 22?

Why attach sshd to loopback only?   If you want to accept connections from 
other machines (which it appears that you do), then allow sshd to accept 
connections from ppp0, albeit on a high port number, and that should solve 
your problem?

Or have I misunderstood what you are trying to do?

Regards,

Antony.

-- 
The idea that Bill Gates appeared like a knight in shining armour to lead all 
customers out of a mire of technological chaos neatly ignores the fact that 
it was he who, by peddling second-rate technology, led them into it in the 
first place.

 - Douglas Adams in The Guardian, 25th August 1995

                                                     Please reply to the list;
                                                           please don't CC me.

Re: martians and portforwarding to 127.0.0.1

[Cedric Blancher]

Le mar 20/04/2004 à 18:33, udo a écrit :
> $path_iptables -t nat -A PREROUTING -p tcp -i $ext_if
> -s 0/0 -d $ext_ip --dport 222 -j DNAT --to
> 127.0.0.1:22

Something is quite wierd here. You say you want to run an unprivilieged
SSHd, so it won't be able to bind port 22... So, please rephrase if I'm
wrong, but I guess you want to redirect connections to port 22 to
127.0.0.1, port 2222. You seems very confused about what you want to
achieve, and the way you're trying to do it.

BTW, do not DNAT to 127.0.0.1.
Use REDIRECT that is designed for this very need :

	iptables -t nat -A PREROUTING -p tcp -i $ext_if \
		-d $ext_ip --dport 22 -j REDIRECT --to-ports 2222

Please correct me if I'm wrong. For other mistakes, see Antony's answer.

-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!