0

I am trying to set up an IPA server to be used from machines that share the same network as the server and machines that don't.

The router's IP address is 12.34.56.78

I am using port forwarding on the router to route the IPA ports and 22 to 192.168.1.100

On machine 192.168.1.101, I can ssh to 192.168.1.100.

On machine some.public.machine.not.on.network, I can ssh to 12.34.56.78.

On machine 192.168.1.101, I can NOT ssh to 12.34.56.78.

What can I change on the router at 12.34.56.78 to allow 192.168.1.101 to access the ports at 192.168.1.100 through 12.34.56.78?

Reasoning: I have machines that will need to authenticate through the IPA server that may be connected locally or remotely.

I have telnet access to the router.

EDIT: For the machines that will always be on the local network, I can do iptables -t nat -A OUTPUT -d 12.34.56.78 -j DNAT --to-destination 192.168.1.100 -- This won't work for machines that are sometimes on, sometimes off, which is why I'm looking for a solution on the router level.

EDIT2: The router is an off-the-shelf product, the Technicolor C2000T. I can telnet in from a local computer, and the output of iptables -t nat -nvL is:

iptables -t nat -nvL Chain PREROUTING (policy ACCEPT 20244 packets, 1384K bytes) pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- ppp2 * 0.0.0.0/0 224.0.0.0/4
7762 470K CapPort tcp -- br0 * 0.0.0.0/0 0.0.0.0/0
446K 33M WanPrerouting all -- ppp2 * 0.0.0.0/0 0.0.0.0/0

Chain POSTROUTING (policy ACCEPT 446K packets, 33M bytes) pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- * ppp2 10.0.0.0/8 0.0.0.0/0
0 0 MASQUERADE all -- * ppp2 172.16.0.0/12 0.0.0.0/0
13303 906K MASQUERADE all -- * ppp2 192.168.0.0/16 0.0.0.0/0

Chain OUTPUT (policy ACCEPT 446 packets, 75081 bytes) pkts bytes target prot opt in out source destination

Chain CapPort (1 references) pkts bytes target prot opt in out source destination

Chain DMZ (1 references) pkts bytes target prot opt in out source destination

Chain PortMap (1 references) pkts bytes target prot opt in out source destination
1 40 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 to:192.168.1.100:443 0 0 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:636 to:192.168.1.100:636 6 300 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 to:192.168.1.100:80 0 0 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:389 to:192.168.1.100:389 0 0 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:88 to:192.168.1.100:88 0 0 DNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:88 to:192.168.1.100:88 0 0 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:464 to:192.168.1.100:464 0 0 DNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:464 to:192.168.1.100:464 0 0 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 to:192.168.1.100:53 445K 33M DNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 to:192.168.1.100:53 2 260 DNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:123 to:192.168.1.100:123 0 0 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:7389 to:192.168.1.100:7389 173 9836 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 to:192.168.1.100:22

Chain Redirects (1 references) pkts bytes target prot opt in out source destination

Chain TechDNAT (1 references) pkts bytes target prot opt in out source destination

Chain WanPrerouting (1 references) pkts bytes target prot opt in out source destination
446K 33M Redirects all -- * * 0.0.0.0/0 0.0.0.0/0
446K 33M TechDNAT all -- * * 0.0.0.0/0 0.0.0.0/0
446K 33M PortMap all -- * * 0.0.0.0/0 0.0.0.0/0
472 45291 DMZ all -- * * 0.0.0.0/0 0.0.0.0/0

  • Your description is really hard to understand, the whole picture cannot be seen. A detailed drawing with machines and all the IP addresses would probably help. However, there is a quite general problem with port forwarding: you have to make sure the reply traffic from the server goes back through the port forwarding device. This means that the client may not have an IP address on the same subnet as the server. You may also implement source NAT (MASQUERADING) for the port forwarded traffic as a workaround, but then you'll not be able to see the source addresses on the server. – Laszlo Valko Oct 10 '14 at 1:17
  • Is this router an off-the-shelf product, or do you have a linux box acting as a router? If this is just a linux box, we need to see the iptables rules on it (iptables -t nat -nvL or iptables-save). – Patrick Oct 10 '14 at 1:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.