0

I installed SSH honeypot cowrie and configured real ssh to use a different port. The honeypot is supposed to use a port n. Iptables is configured to route traffic from port 22 to port %PORT:

iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-port %PORT

Cowrie is just running fine, this works: ssh root@localhost -p %PORT

What's not working is this: ssh root@localhost

Same for remote connections (except, port %PORT is not working, because it's not opened.

ssh: connect to host localhost port 22: Connection refused

Real SSH itself is working pretty fine on it's secret port somewhere.

Those are the nat-rules from iptables:

Chain PREROUTING (policy ACCEPT)
num  target     prot opt source               destination
1    REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:ssh redir ports %PORT

Chain POSTROUTING (policy ACCEPT)
num  target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

Those are the global rules from iptables:

Chain INPUT (policy DROP)
num  target     prot opt source               destination
1    f2b-dovecot-pop3imap  tcp  --  anywhere             anywhere             multiport dports pop3,imap2
2    f2b-sshd   tcp  --  anywhere             anywhere             multiport dports ssh
3    ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
4    ACCEPT     all  --  anywhere             anywhere
5    ACCEPT     icmp --  anywhere             anywhere             icmp echo-request
[... removed some mappings not related to this toppics (http-specific, some mail-ports)]
15   ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:%REAL_SSH_PORT ctstate NEW,ESTABLISHED

Chain FORWARD (policy DROP)
num  target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

Chain f2b-dovecot-pop3imap (1 references)
num  target     prot opt source               destination
1    RETURN     all  --  anywhere             anywhere

Chain f2b-sshd (1 references)
num  target     prot opt source               destination
1    REJECT     all  --  XXXXXXX  anywhere             reject-with icmp-port-unreachable
2    REJECT     all  --  XXXXXXX  anywhere             reject-with icmp-port-unreachable
3    REJECT     all  --  XXXXXXX  anywhere             reject-with icmp-port-unreachable
4    REJECT     all  --  XXXXXXX       anywhere             reject-with icmp-port-unreachable
5    RETURN     all  --  anywhere             anywhere

Some side-notes:

  1. Choosing a different source port, like 99, will also not work
  2. Using a local port forwarding rule like this works pretty fine when connecting from local machine iptables -t nat -A OUTPUT -p tcp --dport 22 -j REDIRECT --to-port %PORT

What am I not seeing here?

  • 1
    Connections from the local system don't traverse the PREROUTING table. I believe for those connections you need to use the OUTPUT chain. You also need to allow %PORT in the INPUT table. – wurtel Oct 14 '19 at 12:58
  • open %PORT in INPUT table... That's it. Spend hours searching. Thanks a lot. You want to post answer or should I answer my question myself? – n.r. Oct 14 '19 at 13:05
0

Thanks to @wurtel - PREROUTING does not imply opening a port. I also had to open the SSH-honeypots port like this:

iptables -A INPUT -p tcp --dport %PORT -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.