topic Re: IPtables rule in Operating System - Linux

IPtables rule

Tom Ward_1 — Sun, 04 Dec 2005 23:19:33 GMT

Hello,

I know what I want, but I don't know how to format it for iptables. I've been going in circles for hours, so hopefully someone can help me with this.

I want to allow external connnections through my router so that I can connect from a specific remote IP to an internal box via ssh. From the remote system I want to ssh to a high number port such as 9876 and have the router send that to an internal box, 192.168.1.20, on port 22.

I've found rules to open up ssh and forward to an internal box, but I want to be selective about which external IPs can connect and I want them coming in on a high port.

I hope that's clear.

Regards,
Tom

Re: IPtables rule

Steven E. Protter — Mon, 05 Dec 2005 04:22:05 GMT

Shalom Tom,

Examples....

-A FORWARD -d 192.168.0.131 -i eth0 -p 47 -j ACCEPT
-A FORWARD -d 192.168.0.131 -i eth0 -p tcp -m tcp --dport 1723 -j ACCEPT
-A FORWARD -d 192.168.0.131 -i eth0 -p 47 -j ACCEPT

forward destination -d port 47 to internal IP address 192.168.0.131 everything from eth0

What you can do is use the -s command with the -i to control the interface

-A FORWARD -d 192.168.0.131 -i eth0 -s 24.123.3.108 -p 47

That's generally what you want so long as your sources have fixed ip addresses.

Change the port and -s source to meet your actual needs.

Post any error messages my code generates.

SEP

Re: IPtables rule

ger donohue_1 — Mon, 05 Dec 2005 19:26:16 GMT

You will also need a nat table rule as well as forwarding rules previously mentioned.

-t nat -A PRETROUTING -i -p tcp -s --destination-port 9876 -j DNAT --to-destination 192.168.1.20:22

-A FORWARD -p tcp -i --destination-port 22 --destination 192.168.1.20 -j ACCEPT

-A FORWARD -s 192.168.1.20 -j ACCEPT

-t nat -A POSTROUTING -p tcp -s 192.168.1.20 -o -j SNAT --to-source

if external addr is dynamically assigned
-t nat -A POSTROUTING -p tcp -s 192.168.1.20 -o ppp0 -j MASQUERADE

You can harden or soften these as applies by specifing the source ports in the POSTROUTING chains.

Re: IPtables rule

Bill Thorsteinson — Tue, 06 Dec 2005 12:00:53 GMT

Consider installing Shorewall.
It will build the NAT rules and opent the
port for you.

Re: IPtables rule

Tom Ward_1 — Thu, 08 Dec 2005 10:23:59 GMT

Thank you for the replies.

I've got one part working -- the subnet restrictions. I haven't worked out the port shifting bit yet.

I'm using floppy firwall. Here's the rules that I have so far.
iptables -A PREROUTING -t nat -p tcp -d ${OUTSIDE_IP} --dport 22 -s 999.999.999.0/24 -j DNAT --to ${SERVER_IP}:22
iptables -A FORWARD -p tcp -s 999.999.999.0/24 -d ${SERVER_IP} --dport 22 -o ${INSIDE_DEVICE} -j ACCEPT
They're just a slight modification of the sample rule given.

I plan to check out bering-uClib. It has shorewall and looks like it's actively maintained.

As a side note I was checking ebay for another 486 like mine to use as test and there aren't many of them for sale anymore. Too bad they work well for routers.

Thanks and Happy Holidays,
Tom