A quick overview for those who are unfamiliar with Open-Mesh:
The system uses small wireless access points that automagically build their own mesh network. As long as one of the access points is connected to the internet through a wired LAN (making that access point the "gateway"), all the access points (and their wireless clients) will have internet access.
The access points run a modified version of OpenWRT.
Normally, the only way to SSH into any of the wireless access points (nodes) is to first SSH into the gateway, then SSH from there to the node.
What I'm trying to do: Open/forward a port to SSH into each wireless node directly.
For example, my gateway is at
10.45.13.220 on my LAN. The first wireless node is at
18.104.22.168 on the mesh network (i.e. typing
ssh email@example.com while logged into the gateway will open a shell to the wireless node). I would like to be able to log into the wireless node like so:
$ ssh -p 11001 firstname.lastname@example.org
So I tried forwarding that port in
iptables using the following commands:
$ iptables -t nat -A PREROUTING -p tcp -d 10.45.13.220 --dport 11001 \ -j DNAT --to-destination 22.214.171.124:22 $ iptables -t filter -A FORWARD -p tcp -d 126.96.36.199 --dport 22 -j ACCEPT`
I know this is doing something because when I try to SSH to
10.45.13.220:11001 (from another computer on the network) before entering the above commands, the connection is refused. But once the commands have been entered, the connection times out.
Any idea what I'm doing wrong? I'm pretty new to
iptables, but this seems like it should be pretty straightforward.
Note: IP forwarding is already enabled
EDIT: Logging Results
After setting up logging for both rules suggested by @slm, this is what
dmesg spits out when I try to connect to 10.45.13.220:11001 from another linux box:
[1015021.850000] IN=br-lan1 OUT= MAC=ac:86:74:0c:fd:00:6c:62:6d:12:85:9d:08:00 \ SRC=10.45.13.246 DST=10.45.13.220 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=16916 DF \ PROTO=TCP SPT=41908 DPT=11001 WINDOW=14600 RES=0x00 SYN URGP=0 [1015021.850000] IN=br-lan1 OUT=br-lan1 MAC=ac:86:74:0c:fd:00:6c:62:6d:12:85:9d:08:00 \ SRC=10.45.13.246 DST=188.8.131.52 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=16916 DF \ PROTO=TCP SPT=41908 DPT=22 WINDOW=14600 RES=0x00 SYN URGP=0 [1015022.850000] IN=br-lan1 OUT=br-lan1 MAC=ac:86:74:0c:fd:00:6c:62:6d:12:85:9d:08:00 \ RC=10.45.13.246 DST=184.108.40.206 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=16917 DF \ PROTO=TCP SPT=41908 DPT=22 WINDOW=14600 RES=0x00 SYN URGP=0
New iptables rules used (as per @slm's suggestion):
iptables -t nat -A PREROUTING -p tcp --dport 11001 -j LOG --log-level debug iptables -t nat -A PREROUTING -p tcp --dport 11001 -j DNAT --to 220.127.116.11:22 iptables -A FORWARD -i br-lan1 -p tcp -j LOG --log-level debug iptables -A FORWARD -i br-lan1 -o bat0.2@bat0 -p tcp -d 18.104.22.168 --dport 22 \ -j ACCEPT