RE: SSH and NAT

RE: SSH and NAT

[Brad Morgan]

> I'm having a slight problem with SSH and NAT. I've got an ADSL
> connection with a single static IP, and I'd like to be able to SSH to
> any of my boxes within my network, but without having to use separate
> ports to do it. Is this possible?
>
> My setup is:
> 
> Internet -> ZyXEL ADSL router (192.168.0.1) -> Debian Server
> (192.168.0.2) -> box1 (0.3) / box2 (0.4)

I assume you mean from the Internet.  If that's the case, then the
answer is no.  Your box1 and box2 are in a private address space which
by definition, isn't routed to the outside world.  What your router
sees is packets with resolved IP addresses.  There are no names in
the packets at this point.  You only have one public IP address.

You have two choices.  One you've mentioned which is to use separate
ports for each machine which are then DNATed from the server to the
right box.  The second is to use ssh twice, once from the outside to
the Debian server, and then from there to the box of your choice.

Regards,

Brad Morgan

Re: SSH and NAT

[Kim Jensen]

On Monday 24 March 2003 21:36, James O'Gorman wrote:
> What I thought, was if I set up box1.domain.com and box2.domain.com as A
> records of my external IP with my ISP, then get iptables to read
> 'box1.domain.com' from a string in the header it might work, but
> obviously not. Does the IP packet header only contain IP, or address as
> well?
>
The IP packet only contain some primitive information - if you wish to deal 
with names, then you have to use DNS. You can't store the name information in 
the packet header.

I can recommend that you read about IP headers if you wish to know more about 
the construction of these magic little packets :-)

/Kim

Re: SSH and NAT

[Marcelo Moreira]

> > The IP packet only contain some primitive information - if you wish to
deal
> > with names, then you have to use DNS. You can't store the name
information in
> > the packet header.
>
> Not quite sure what you mean by this? I've set up the DNS so that box1
> and box2 both point to an IP (albeit the same one as I only have the
> one) - an A record on the DNS server.

Ok. Let me see if I can explain this a little bit better.
An IP packet has only the numeric address information on it.
So essentialy, a ssh packet to box1 and another to box2 are
the same (except for time, sequence, flags, etc).
The DNS information is not on the IP header at all. It is just
another protocol that is used to map names to numeric addresses.

> > I can recommend that you read about IP headers if you wish to know more
about
> > the construction of these magic little packets :-)
>
> I understand bits of it, but obviously not enough. :)
> Guess I should get reading!

Yes, I guess you should also. In fact, get the definitive IP guide:
TCP/IP Illustrated, Vols I II and III. Author is Stevens.
Have fun on your reading...

Marcelo.