I need to accomplish port forwarding from a global IP address to a specific local IP address on a local system running on Linux that is connected to the Internet via a Squid Proxy Server Running over Linux.

The Squid Proxy Server has a global IP address, and, Internet connections are routed through it to the almost all local systems that have static local IP addresses. The Global IP address is in the 210.*.*.* range, and, the local IP addresses are in the range of 192.168.*.*

How do I accomplish this.

  • Without more details, this is a request for a manual, not a specific question. Note that the information provided is not sufficient for anyone to give you a straight answer. It mainly misses your current routing and firewall rules. When you say that the "Internet connections are routed through it", do you mean that some ports are already forwarded to local machines (IPs)? If it is, you should simply copy one of those rules and simply change the port and local IP. – Julie Pelletier Jan 13 '17 at 5:12
  • You can use SNAT one Global IP to One Local IP. – supriady Jan 13 '17 at 5:53
  • Apologies, my intention was to keep the question short and simple, I did not expect the manual. There are no specific routing and firewall rules as far as I know except for entries in the /etc/host.allow file to allow only certain IP addresses to ssh to the Squid server remotely. I need to one local system to be accessed by a remote system with a global IP which is part of our organization and sits at another geographic location, the local system sits behind a Squid Proxy Server. I need to set up ssh access to the local system, so that it can be accessed from the remote system directly. – I got it now you get it Jan 13 '17 at 5:57
  • If you want to be able to reach both machines with ssh, then you'll need to use different ports. – Julie Pelletier Jan 13 '17 at 7:31
  • 1
    here's your answer - serverfault.com/questions/140622/… – 13dimitar Jan 13 '17 at 7:38

An easy way is to rely exclusively on NATing:

Forward all packets reaching the $PUBLICIP on port 2222 to $LOCALIP on port 22:

iptables -t nat -A PREROUTING -d $PUBLICIP/32 -p tcp -m tcp --dport 2222 -j DNAT --to-destination $LOCALIP:22

Route the traffic coming from $LOCALIP on the $PUBLICIP's interface:

iptables -t nat -A POSTROUTING -s $LOCALIP/32 -j SNAT --to-source $PUBLICIP

Then you can simply ssh -p 2222 $PUBLICIP from your local system.

  • This would mean that any incoming ssh request would be forwarded to the particular local IP, is it not. – I got it now you get it Jan 19 '17 at 10:40
  • Routing and filtering are not done at the application level so you don't care if it's ssh, you simply look at the IP and port. So accessing your public IP on port 2222 would access the VPN machine on port 22. – Julie Pelletier Jan 19 '17 at 14:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.