1

I installed SSH honeypot cowrie and configured real ssh to use a different port. The honeypot is supposed to use a port n. Iptables is configured to route traffic from port 22 to port %PORT:

iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-port %PORT

Cowrie is just running fine, this works:

ssh root@localhost -p %PORT

What's not working is this:

ssh root@localhost

Same for remote connections (except, port %PORT is not working, because it's not opened.

ssh: connect to host localhost port 22: Connection refused

Real SSH itself is working pretty fine on it's secret port somewhere.

Those are the nat-rules from iptables:

Chain PREROUTING (policy ACCEPT)
num  target     prot opt source               destination
1    REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:ssh redir ports %PORT

Chain POSTROUTING (policy ACCEPT)
num  target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

Those are the global rules from iptables:

Chain INPUT (policy DROP)
num  target     prot opt source               destination
1    f2b-dovecot-pop3imap  tcp  --  anywhere             anywhere             multiport dports pop3,imap2
2    f2b-sshd   tcp  --  anywhere             anywhere             multiport dports ssh
3    ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
4    ACCEPT     all  --  anywhere             anywhere
5    ACCEPT     icmp --  anywhere             anywhere             icmp echo-request
[... removed some mappings not related to this toppics (http-specific, some mail-ports)]
15   ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:%REAL_SSH_PORT ctstate NEW,ESTABLISHED

Chain FORWARD (policy DROP)
num  target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

Chain f2b-dovecot-pop3imap (1 references)
num  target     prot opt source               destination
1    RETURN     all  --  anywhere             anywhere

Chain f2b-sshd (1 references)
num  target     prot opt source               destination
1    REJECT     all  --  XXXXXXX  anywhere             reject-with icmp-port-unreachable
2    REJECT     all  --  XXXXXXX  anywhere             reject-with icmp-port-unreachable
3    REJECT     all  --  XXXXXXX  anywhere             reject-with icmp-port-unreachable
4    REJECT     all  --  XXXXXXX       anywhere             reject-with icmp-port-unreachable
5    RETURN     all  --  anywhere             anywhere

Some side-notes:

  1. Choosing a different source port, like 99, will also not work

  2. Using a local port forwarding rule like this works pretty fine when connecting from local machine

    iptables -t nat -A OUTPUT -p tcp --dport 22 -j REDIRECT --to-port %PORT
    

What am I not seeing here?

2
  • 1
    Connections from the local system don't traverse the PREROUTING table. I believe for those connections you need to use the OUTPUT chain. You also need to allow %PORT in the INPUT table.
    – wurtel
    Oct 14, 2019 at 12:58
  • open %PORT in INPUT table... That's it. Spend hours searching. Thanks a lot. You want to post answer or should I answer my question myself?
    – n.r.
    Oct 14, 2019 at 13:05

1 Answer 1

0

Thanks to @wurtel - PREROUTING does not imply opening a port. I also had to open the SSH-honeypots port like this:

iptables -A INPUT -p tcp --dport %PORT -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .