I'm setting up SSH access to my own Git server and I've done some prerouting because SSH server is not listening on standard port because Git server is run by non-root user. This is the rule I currently have in my UFW's before.rules:

-A PREROUTING -p tcp --dport 22 -j REDIRECT --to-port 2222

It works well, but I have a little problem with it because I'm running VPN on same server and in case that I want to connect to some other SSH on different IP, this port is also redirected to 2222. I would only like that requests for my IP were prerouted from port 22 to 2222 and not also for other IPs. How should I change this rule to work with my IP even if I access my SSH server from the same machine (localhost, my IP)?


You can use -i to match the interface the packet was received on or -d to match the destination like so:

-A PREROUTING -p tcp --dport 22 -d <SERVER-IP> -j REDIRECT --to-port 2222

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.