0

I have a OpenVPN server with two clients attached. The clients do not have public IP addresses, so the only way to SSH into them is through the VPN.

The machine running the server is behind a router with a public IP address of w.x.y.z. The server's LAN address is 10.0.0.5. The router's LAN address is 10.0.0.1 and has the machine running the server (10.0.0.5) as the DMZ.

Client #1 always gets a VPN address of 192.168.2.6 and runs an ssh service on port 1802

Client #2 always gets a VPN address of 192.168.2.14 and runs an ssh service on port 1804

What I would like to do is be able to ssh to these clients from anywhere by saying

ssh w.x.y.z -p1802

for the first client and

ssh w.x.y.z -p1804

for the second client.

I've set up iptables with the following rules:

:OUTPUT ACCEPT [6473:428732]  
-A PREROUTING -d w.x.y.z -p tcp -m tcp --dport 1802 -j DNAT --to-destination 192.168.2.6  
-A PREROUTING -d w.x.y.z -p tcp -m tcp --dport 1804 -j DNAT --to-destination 192.168.2.14

Here are my routing tables:

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface  
192.168.2.2     *               255.255.255.255 UH    0      0        0 tun0  
192.168.2.0     192.168.2.2     255.255.255.0   UG    0      0        0 tun0  
10.0.0.0        *               255.255.255.0   U     0      0        0 eth0  
169.254.0.0     *               255.255.0.0     U     0      0        0 eth0  
default         10.0.0.1        0.0.0.0         UG    0      0        0 eth0 

ifconfig output:

[root@osrv sysconfig]# /sbin/ifconfig  
eth0      Link encap:Ethernet  HWaddr 80:51:EA:74:92:A5  
          inet addr:10.0.0.6  Bcast:10.0.0.255  Mask:255.255.255.0  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1  
          RX packets:4554899 errors:0 dropped:0 overruns:0 frame:0  
          TX packets:4568878 errors:0 dropped:0 overruns:0 carrier:0  
          collisions:0 txqueuelen:1000 
          RX bytes:1083718390 (1.0 GiB)  TX bytes:1131399760 (1.0 GiB)  
          Interrupt:11 Base address:0xa000  

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0  
          UP LOOPBACK RUNNING  MTU:16436  Metric:1  
          RX packets:11833 errors:0 dropped:0 overruns:0 frame:0  
          TX packets:11833 errors:0 dropped:0 overruns:0 carrier:0  
          collisions:0 txqueuelen:0  
          RX bytes:5197664 (4.9 MiB)  TX bytes:5197664 (4.9 MiB)  

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:192.168.2.1  P-t-P:192.168.2.2  Mask:255.255.255.255  
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1  
          RX packets:985135 errors:0 dropped:0 overruns:0 frame:0  
          TX packets:947116 errors:0 dropped:0 overruns:0 carrier:0  
          collisions:0 txqueuelen:100  
          RX bytes:215916038 (205.9 MiB)  TX bytes:429598806 (409.6 MiB)  

With it set up like this, if I am logged into the server, I can ssh to either client with

ssh 192.168.2.6 -p 1802
ssh 192.168.2.14 -p1804

and both work just fine.

However when I try to do this from the internet:

ssh w.x.y.z -p 1802

works fine but

ssh w.x.y.z -p 1804

doesn't respond.

What did I miss?

0

I guess I will answer my own question.

I left out the SNAT rules. This fixed it:
-A POSTROUTING -d 192.168.2.6 -p tcp -m tcp --dport 1624 -j SNAT --to-source 192.168.2.1
-A POSTROUTING -d 192.168.2.14 -p tcp -m tcp --dport 1626 -j SNAT --to-source 192.168.2.1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.