This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

ssh port forwarding don't work

Hi:

I want to do a port forwarding for ssh from external lan to a server in dmz. The same for www, ftp, telnet and any others. All work fine but ssh don't work. I have read in the forum something like do a NAT from external NIC to ssh server in dmz. Why? ssh is not de same that www, ftp or telnet that are working fine?. I know that I can't go to port 22 directly because is the port of ssh in the firewall. I have take port 2222.

More info:

0 0 DNAT tcp -- * * 0.0.0.0/0 a.b.c.d tcp spts:1024:65535 dpt:2222 to:172.26.0.2:22
0 0 DNAT udp -- * * 0.0.0.0/0 a.b.c.d udp spts:1024:65535 dpt:2222 to:172.26.0.2:22

Packet filter let pass this packets.

Do you know where is the fault?

Thanks

This thread was automatically locked due to age.

Parents

0 oliver.desch over 22 years ago

Puilla,

ssh uses source ports lower than 1024 (privileged ports)
You have two possibilities, first is to change
your NAT rules, second is to call ssh with the
option -P .

Why? ssh is not de same that www, ftp or telnet
It is!

read you
o|iver
Cancel
Vote Up 0 Vote Down

Cancel
0 Puilla over 22 years ago in reply to oliver.desch

Hi oliver:

Whitch port must I change? 1024:65535 in source port, or 2222 in destination port?

In first case will we 0:1024 ?
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Puilla over 22 years ago in reply to oliver.desch

Hi oliver:

Whitch port must I change? 1024:65535 in source port, or 2222 in destination port?

In first case will we 0:1024 ?
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 oliver.desch over 22 years ago in reply to Puilla

Puilla,

0 0 DNAT tcp -- * * 0.0.0.0/0 a.b.c.d tcp spts:1024:65535 dpt:2222 to:172.26.0.2:22
Your DNAT rule translates only packets from source ports
from 1024 to 65535, but you need to DNAT from 1:65535,
so the easiest way would be to change your service
to source port 1:65535 and destination port 2222!

read you
o|iver

[size="1"][ 19 June 2002, 12:53: Message edited by: oliver.desch ][/size]
Cancel
Vote Up 0 Vote Down

Cancel
0 Puilla over 22 years ago in reply to oliver.desch

Hi:

Still not working!!!!

Where can I see the logs? in /var/log/kernel or /var/log/daemon don't show nothing about the incoming connections.
Cancel
Vote Up 0 Vote Down

Cancel
0 Puilla over 22 years ago in reply to Puilla

Hi:

I try the connection thru a ipsec vpn from client to server and don't work!!!!!!

What about ssh???? [:S]
Cancel
Vote Up 0 Vote Down

Cancel