2

I'm running a test server behind NAT. I've forwarded remote port 2222 from another public IP server (example.com) to port 22 of the server behind NAT (localhost) as follows.

autossh -f -N -i /root/.ssh/id_rsa -R 2222:localhost:22 root@example.com

Now the local ssh server behind NAT getting only ::1 as IP address of all clients irrespective of client's actual IP address.

Output from w in localhost is like this.

 22:27:37 up  8:03,  2 users,  load average: 0.03, 0.03, 0.09
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
user tty7     :0               14:24    8:03m  1.27s  0.33s /usr/bin/lxsession -s LXDE-pi -e LXDE
user pts/0    ::1              22:27    1.00s  0.34s  0.03s w

/var/log/auth.log in localhost has entry like this

Feb 28 22:27:32 localhost sshd[5201]: Accepted password for user from ::1 port 55168 ssh2

Now I want to run fail2ban or csf firewall to block spam IP addresses. So, I want client's actual IP address. How can I do this? Is any iptables NAT rewriting rule helpful?

  • You cannot use failtoban to block IPs and you only see the IP address of the other side of the SSH tunnel... – Rui F Ribeiro Mar 2 '18 at 19:40
  • @RuiFRibeiro Yes, that's true. I'm asking is there a way to get the client's actual IP instead the IP address of other side of the tunnel's localhost ip ::1? – Abhik Bose Mar 2 '18 at 19:43
  • 1
    I prefer going in via a VPN and not expose ssh ports to the Internet. – Rui F Ribeiro Mar 2 '18 at 19:51
  • 1
    Maybe running a tun device and using iptables would be the solution? – davidbaumann Mar 3 '18 at 8:01
0

The SSH protocol messages for opening a TCP forwarding session include the IP address and port of the client which connected to the forwarded port. The OpenSSH ssh utility just logs the information and doesn't do anything else with it:

$ ssh -v -R 2048:localhost:22 localhost
...
debug1: client_request_forwarded_tcpip: listen localhost port 2048, originator ::1 port 49341
                                                                    ^^^^^^^^^^^^^^^^^^^^^^^^^

To do something useful with the information, you'd have to do one of the following:

  • Run ssh in debug mode and capture and parse the relevant debug output.
  • Modify the ssh utility to log the information or otherwise do what you need it to do with the information.
  • Use a different ssh client, or write your own. SSH libraries exist for most modern programming languages.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.