2

I tried to set up a nginx server for my pi's at home. The problem was, the dyndns take too long to update. therefore I can't access my gitolite server.

So instead of using dyndns, I set up a ec2 instance. every traffic that go to my domains, will using this ec2 ip. from there, I use nginx to moderate traffic to my pi's. I got it working pretty well with http and https server. and I can also set up a stream server to my ssh. Now come the problem. From what I read, the ssh protocol doesn't give the dns. Well I am not an sysadmin, so maybe the terms I used were incorrect.

I install fail2ban in my pi. every ssh traffic go through the nginx server, using the same ip. and then when it got blocked by the fail2ban. I can't access them at all.

for them who want to use nginx. Im not recommended, but this is working.

stream {
    upstream ssh {
        server xx.xxx.xxx.xxx:22;
    }

    server {
        listen        22;
        proxy_pass    ssh;
    }            

    upstream ssh {
        server xx.xxx.xxx.xxx:2288;
    }

    server {
        listen        2288;
        proxy_pass    ssh;
    }

}

This is only working for nginx ^1.2 I guess.

I tried all the possible config:

#   proxy_bind $remote_addr:$remote_port transparent;
#   proxy_bind $remote_addr transparent;
#   proxy_set_header Host $host;
#   proxy_protocol on;

none of them pass the ip. Maybe someone know what is wrong with the configurations?

I read also some suggestion to use iptables instead. and then i tried all the one below:

#iptables -t nat -I PREROUTING -p tcp -i eth4 --dport 22 -j DNAT --to xx.xxx.xxx.xxx:22
#iptables -A FORWARD -i eth4 -o eth1 -p tcp --dport 22 -j ACCEPT
#iptables -t nat -A PREROUTING -p tcp -i ppp0 --dport 22 -j DNAT --to-destination xx.xxx.xxx.xxx
#iptables -A FORWARD -p tcp -d xx.xxx.xxx.xxx --dport 22 -m state --state NEW,ESTABLISHED,RELAT$
#iptables -t nat -A PREROUTING -p tcp --dport 22 -j DNAT --to-destination xx.xxx.xxx.xxx:2244

#iptables -A FORWARD -m state -p tcp -d xx.xxx.xxx.xxx --dport 22 --state NEW,ESTABLISHED,RELAT$
#iptables -t nat -A PREROUTING -p tcp --dport 22 -j DNAT --to-destination xx.xxx.xxx.xxx:2244

I am not sure, why it is not working. -i eth4 -o eth1 i guess this one is the networking isn't it, including the ppp0? My pi only has one eth0.

can someone tell me, what is the problem here? can I used the same port for out and in? or it has to be different port at all? Some explanations about the iptables config would be helpful.

Thank you!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.