Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

A quick overview for those who are unfamiliar with Open-Mesh:

The system uses small wireless access points that automagically build their own mesh network. As long as one of the access points is connected to the internet through a wired LAN (making that access point the "gateway"), all the access points (and their wireless clients) will have internet access.

The access points run a modified version of OpenWRT.

Normally, the only way to SSH into any of the wireless access points (nodes) is to first SSH into the gateway, then SSH from there to the node.

What I'm trying to do: Open/forward a port to SSH into each wireless node directly.

For example, my gateway is at 10.45.13.220 on my LAN. The first wireless node is at 5.12.252.248 on the mesh network (i.e. typing ssh root@5.12.252.248 while logged into the gateway will open a shell to the wireless node). I would like to be able to log into the wireless node like so:

$ ssh -p 11001 root@10.45.13.220

So I tried forwarding that port in iptables using the following commands:

$ iptables -t nat -A PREROUTING -p tcp -d 10.45.13.220 --dport 11001 \
          -j DNAT --to-destination 5.12.252.248:22

$ iptables -t filter -A FORWARD -p tcp -d 5.12.252.248 --dport 22 -j ACCEPT`

I know this is doing something because when I try to SSH to 10.45.13.220:11001 (from another computer on the network) before entering the above commands, the connection is refused. But once the commands have been entered, the connection times out.

Any idea what I'm doing wrong? I'm pretty new to iptables, but this seems like it should be pretty straightforward.

Note: IP forwarding is already enabled

EDIT: Logging Results

After setting up logging for both rules suggested by @slm, this is what dmesg spits out when I try to connect to 10.45.13.220:11001 from another linux box:

[1015021.850000] IN=br-lan1 OUT= MAC=ac:86:74:0c:fd:00:6c:62:6d:12:85:9d:08:00 \
SRC=10.45.13.246 DST=10.45.13.220 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=16916 DF \
PROTO=TCP SPT=41908 DPT=11001 WINDOW=14600 RES=0x00 SYN URGP=0

[1015021.850000] IN=br-lan1 OUT=br-lan1 MAC=ac:86:74:0c:fd:00:6c:62:6d:12:85:9d:08:00 \
SRC=10.45.13.246 DST=5.12.252.248 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=16916 DF \
PROTO=TCP SPT=41908 DPT=22 WINDOW=14600 RES=0x00 SYN URGP=0

[1015022.850000] IN=br-lan1 OUT=br-lan1 MAC=ac:86:74:0c:fd:00:6c:62:6d:12:85:9d:08:00 \
RC=10.45.13.246 DST=5.12.252.248 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=16917 DF \
PROTO=TCP SPT=41908 DPT=22 WINDOW=14600 RES=0x00 SYN URGP=0

New iptables rules used (as per @slm's suggestion):

iptables -t nat -A PREROUTING -p tcp --dport 11001 -j LOG --log-level debug
iptables -t nat -A PREROUTING -p tcp --dport 11001 -j DNAT --to 5.12.252.248:22
iptables -A FORWARD -i br-lan1 -p tcp -j LOG --log-level debug
iptables -A FORWARD -i br-lan1 -o bat0.2@bat0 -p tcp -d 5.12.252.248 --dport 22 \
    -j ACCEPT
share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

This isn't necessary with ssh. You can ssh through one host to another host like so:

$ ssh -t serverA ssh serverB

Example

$ hostname
grinchy

$ ssh -t skinner ssh mulder
Last login: Fri Aug 16 18:19:56 2013 from skinner.somedom.net

$ hostname
mulder.somedom.net
$

iptables

If you absolutely want to forward the port I believe this rule will do it:

$ iptables -t nat -A PREROUTING -p tcp -d 10.45.13.220 --dport 11001 -j DNAT --to 5.12.252.248:22
$ iptables -A FORWARD -i eth1 -o eth0 -p tcp -d 5.12.252.248 --dport 22 -j ACCEPT

Where eth1 is exterior interface and eth0 is the interior interface.

share|improve this answer
    
Awesome, thanks for the help! I won't be able to try this out until I'm back at the office on Monday, but I'll let you know how it goes (and mark as answered if all goes well). –  Kyle G. Aug 17 '13 at 0:04
    
@KyleG. - give it a try, it might need to be adjusted, let me know and I can help out. –  slm Aug 17 '13 at 0:06
    
Just gave it a try but I'm still having the same issue. Do you know if there are any logs I can check to shed some light on where the communication is failing? I'm also looking at a way to implement your first suggestion, but it doesn't look like the C# SSH library I'm using supports hopping like that. –  Kyle G. Aug 19 '13 at 14:43
    
Ok I've got it logging. Please see the edit to my question above. –  Kyle G. Aug 19 '13 at 15:09
    
@KyleG. - did you adapt the rules I provided? If so could you add those to your Edit you made just so I can see what you ultimately ended up using? –  slm Aug 19 '13 at 15:38
show 4 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.