0

I am trying to figure out an issue I have been having. I am using a webpanel called TinyCP and there is a table for displaying failed login attemps via SSH.

All SSH attempts, failed or successful, show that they are coming from my NAT. This then gives them all the same IP addresses and disabled me from using fail2ban to try and stop penetration tests.

I had this same issue on my web server and fixed it by using the mod_remoteip for apache to redirect X-Forwarded-For to the Remote IP.

Is it possible to do something like this with SSH so I am able to retrieve the actual public IP instead of the NAT?

Example:

  • Please clarify: Are you connecting to SSH via a HTTP proxy's CONNECT? Or are you "just" using a NATed connection? Or both? – Hermann May 16 at 17:51
  • My connection is through a NAT. I am using a stock OpenSSH Server install – ImJT May 16 at 17:56
1

No

Performing network address translation (NAT) is conceptually very different from using a HTTP proxy server.

There is no way to tell the remote's private local IPv4 address. It would defeat the very purpose of NAT (that is aggregating a network into a singl host).

On a side note: FTP reveals the remote's address (and it lead to problems with NATed networks ever since). I just checked the SSH memo – the remote's private IP address is never transmitted (and there is no reason to do so).

Change your network configuration so that you can perform your tests with direct (not NATed) connections.

  • I am unable to change to a non NAT connection, my server is being temporarily hosted at my school's ISD and I have no control over that. The reason I assumed the public address gets sent is because if I check my log files, it shows these messages: ` Failed password for invalid user root from 10.20.240.240 port 31028 ssh2`. It shows the NAT IP, just like my PHP projects did. – ImJT May 17 at 13:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.