Re: ssh connecting to wrong machine....

[George Georgalis <georgw@galis.org>]

I tried adding this to the nat but it didn't fix it...

iptables -t nat -A POSTROUTING -p tcp -s $LAN_host04 -j SNAT --to-source $EXT_host04

:-\

Is my masq getting in the way? What's the best way to fix?


# iptables -t nat -vL
Chain PREROUTING (policy ACCEPT 815K packets, 38M bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       tcp  --  any    any     $EXT_host04	  anywhere           to:$LAN_host04
    0     0 DNAT       tcp  --  any    any     anywhere             anywhere           tcp dpt:50422 to:$LAN_host04:22

Chain POSTROUTING (policy ACCEPT 5896 packets, 363K bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 SNAT       tcp  --  any    any     us04                 anywhere           to:$EXT_host04
    0     0 MASQUERADE  all  --  any    eth1    anywhere             anywhere

Chain OUTPUT (policy ACCEPT 58945 packets, 3850K bytes)
 pkts bytes target     prot opt in     out     source               destination


Thanks,
// George


On Sun, Jun 02, 2002 at 07:21:57PM -0400, George Georgalis wrote:
>On a 2 interface firewall, I've set up an alias eth1:1 ($EXT_host04) to
>an IP on our T-1, then added a nat which should connect ports $TCP_OPEN
>and $UDP_OPEN to the internal IP ($LAN_host04).
>
>But when I go to ssh $EXT_host04 from the internet I end up talking to
>the firewall sshd, not the sshd on $LAN_host04. Why is that? Here are my
>rules:
>
>LANIF=eth0
>EXTIF=eth1
>TCP_OPEN="22,25,53,80"
>UDP_OPEN="22,53"
>
>iptables -A INPUT -m state --state ESTABLISHED,RELATED \
>-j ACCEPT
>
>iptables -A INPUT -i $EXTIF -m state --state NEW \
>-p tcp -m multiport --dport $TCP_OPEN -j ACCEPT
>
>iptables -A INPUT -i $EXTIF -m state --state NEW \
>-p udp -m multiport --dport $UDP_OPEN -j ACCEPT
>
>
>iptables -A FORWARD -i $EXTIF -o $LANIF -p tcp \
>-m multiport --dport $TCP_OPEN \
>-m state --state NEW,RELATED,ESTABLISHED \
>-j ACCEPT
>
>iptables -A FORWARD -i $EXTIF -o $LANIF -p udp \
>-m multiport --dport $UDP_OPEN \
>-m state --state NEW,RELATED,ESTABLISHED \
>-j ACCEPT
>
>
>iptables -t nat -A PREROUTING -p tcp \
>-s $EXT_host04 \
>-j DNAT --to-destination $LAN_host04
>
>iptables -t nat -A POSTROUTING -o $EXTIF \
>-j MASQUERADE
>
>
>Thanks,
>// George
>
>-- 
>GEORGE GEORGALIS, System Admin/Architect    cell: 347-451-8229 
>Security Services, Web, Mail,            mailto:george@galis.org 
>File, Print, DB and DNS Servers.       http://www.galis.org/george 
>

-- 
GEORGE GEORGALIS, System Admin/Architect    cell: 347-451-8229 
Security Services, Web, Mail,            mailto:george@galis.org 
File, Print, DB and DNS Servers.       http://www.galis.org/george