Wednesday, December 23, 2015

linux - ssh port forwarding with firewall-cmd

I'm trying to do an ssh tunnel into a server behind NAT:



ssh from laptop --> Host with port forwarding in firewall --> Get directly into guest (172.16.0.2, behind host NAT).



Using iptables on Host - it will work:




# iptables -I OUTPUT  -d 0.0.0.0/0 -j ACCEPT
# iptables -I FORWARD -d 0.0.0.0/0 -j ACCEPT
# iptables -I INPUT -d 0.0.0.0/0 -j ACCEPT
# iptables -t nat -I PREROUTING -d 0.0.0.0/0 -p tcp --dport 222 -j DNAT --to-destination 172.16.0.2:22


However, iptables are not saved on Host reboot, since firewalld service is running (firewalld is the default in RHEL 7).



So I'm trying to do the same port forwarding with firewall-cmd.




Using firewall-cmd on Host - it will NOT work:



# firewall-cmd --permanent --zone=public --add-forward-port=port=222:proto=tcp:toport=22:toaddr=172.16.0.2'
# firewall-cmd --permanent --zone=public --add-masquerade
# firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 0 -d 0.0.0.0/0 -j ACCEPT
# firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -d 0.0.0.0/0 -j ACCEPT
# firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -d 0.0.0.0/0 -j ACCEPT

# firewall-cmd --permanent --direct --add-rule ipv4 nat PREROUTING 0 -d 0.0.0.0/0 -p tcp --dport 222 -j DNAT --to-destination 172.16.0.2:22


# firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" forward-port port="222" protocol="tcp" to-port="22" to-addr='"172.16.0.2"

# firewall-cmd --reload

# firewall-cmd --list-all

public (active)
target: default
icmp-block-inversion: no
interfaces: enp4s0f0

sources:
services: ssh dhcpv6-client
ports: 8139/tcp
protocols:
masquerade: yes
forward-ports: port=222:proto=tcp:toport=22:toaddr=172.16.0.2
source-ports:
icmp-blocks:
rich rules:
rule family="ipv4" destination address="0.0.0.0/0" forward-port port="222" protocol="tcp" to-port="22" to-addr="172.16.0.2"


# firewall-cmd --direct --get-all-rules

ipv4 filter INPUT 0 -d 0.0.0.0/0 -j ACCEPT
ipv4 filter OUTPUT 0 -d 0.0.0.0/0 -j ACCEPT
ipv4 filter FORWARD 0 -d 0.0.0.0/0 -j ACCEPT
ipv4 nat PREROUTING 0 -d 0.0.0.0/0 -p tcp --dport 222 -j DNAT --to-destination 172.16.0.2:22






Now, when trying to connect to the guest - from my laptop, via host port 222 - the ssh connection is refused:



ssh -l stack my-host -p 222
ssh: connect to host my-host port 222: Connection refused


Any idea what am I missing ?

No comments:

Post a Comment

linux - How to SSH to ec2 instance in VPC private subnet via NAT server

I have created a VPC in aws with a public subnet and a private subnet. The private subnet does not have direct access to external network. S...