0

I am trying to redirect traffic coming from the Internet into an SSH tunnel on localhost with iptables, on port 2025. For some reason the redirect doesn't work.

I connected to it with telnet and it echoes back for some reason but doesn't show the banner from the SMTP server its redirecting to. If I telnet on the system this redirect is on, to port 2025 I immediately get a greeting from the SMTP server.

Connecting from the outside world and pressing random keys:

$ telnet infantile.xyz 25
Trying 94.156.189.160...
Connected to infantile.xyz.
Escape character is '^]'.
cfvghnjdfghdfgh

It echoes back the random keys.

Connecting on the system where the redirect is, shows how I want things to work for outsiders on the Internet...

# telnet localhost 2025
Trying ::1...
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 infantile.xyz ESMTP Postfix (Debian/GNU)

My iptables config is as follows:

Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 252M  124G ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
 270K   16M ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
  308 12340 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
 8988  612K ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8 ctstate NEW
2277K  462M UDP        udp  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate NEW
3204K  147M TCP        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp flags:0x17/0x02 ctstate NEW
2277K  462M REJECT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
2914K  130M REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with tcp-reset
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-proto-unreachable

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 1855 packets, 447K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain TCP (1 references)
 pkts bytes target     prot opt in     out     source               destination         
22104 1144K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22
 4976  265K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
 2585  145K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443
   95  4836 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:587

Chain UDP (1 references)
 pkts bytes target     prot opt in     out     source               destination

The NAT rules for this ruleset where the redirect I created is:

Chain PREROUTING (policy ACCEPT 3813 packets, 465K bytes)
 pkts bytes target     prot opt in     out     source               destination         
 2954  174K DNAT       tcp  --  *      *       0.0.0.0/0            94.156.189.0/24      tcp dpt:25 to:127.0.0.1:2025

Chain INPUT (policy ACCEPT 3 packets, 110 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 6798 packets, 408K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 11177 packets, 583K bytes)
 pkts bytes target     prot opt in     out     source               destination    

It is strange that it accepts the connection and echoes but doesn't respond in anyway the service on the other end (postfix) would.

I originally configured iptables with this guide: https://wiki.archlinux.org/index.php/simple_stateful_firewall

This is what I've tried to use to redirect:

iptables -t nat -I PREROUTING -i eth0 -p tcp -d 94.156.189.160 --dport 25 -j DNAT --to-destination 127.0.0.1:2025

I enabled the following sysctl options:

net.ipv4.conf.all.forwarding = 1
net.ipv4.conf.all.route_localnet = 1
6
  • Do you have ip_forwarding enabled? cat /proc/sys/net/ipv4/ip_forward. Should be '1'.
    – slm
    Jul 3, 2018 at 7:35
  • The other thing I like to do in these situations, is tcpdump -i any -nvvXSs0 port 2025 to see if the traffic is ingressing/egressing properly. It's likely the case that your iptables is not set up properly and you're not getting any of the response traffic flowing back out.
    – slm
    Jul 3, 2018 at 7:37
  • Related - digitalocean.com/community/tutorials/….
    – slm
    Jul 3, 2018 at 7:37
  • It looks like your FORWARD chain in iptables seems to be configured to drop everything. Maybe you might need to configure that one as well? Jul 3, 2018 at 7:49
  • I made the default accept for the FORWARD chain and /proc/sys/net/ipv4/ip_forward is 1 but it isn't working.
    – Kaizu
    Jul 3, 2018 at 8:30

1 Answer 1

0

To redirect a port through this firewall you require some iptables rules in the TCP chain and a change in FORWARD chain policy.

Forward chain should be on accept:

# iptables -P FORWARD ACCEPT

You need to allow both the port being redirected from and its target:

# iptables -A TCP -p tcp --dport 25 -j ACCEPT
# iptables -A TCP -p tcp --dport 2025 -j ACCEPT

This POSTROUTING rule...

# iptables -t nat -A POSTROUTING -j MASQUERADE
# iptables -t nat -I PREROUTING -i eth0 -p tcp -d 94.156.189.160 --dport 25 -j DNAT --to-destination 127.0.0.1:2025

With these rules iptables now redirects incoming packets on port 25 to an SSH tunnel on localhost port 2025. The masquerade rule lets packets back out.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .