I installed SSH honeypot cowrie and configured real ssh to use a different port. The honeypot is supposed to use a port n. Iptables is configured to route traffic from port 22
to port %PORT
:
iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-port %PORT
Cowrie is just running fine, this works:
ssh root@localhost -p %PORT
What's not working is this:
ssh root@localhost
Same for remote connections (except, port %PORT is not working, because it's not opened.
ssh: connect to host localhost port 22: Connection refused
Real SSH itself is working pretty fine on it's secret port somewhere.
Those are the nat-rules from iptables:
Chain PREROUTING (policy ACCEPT)
num target prot opt source destination
1 REDIRECT tcp -- anywhere anywhere tcp dpt:ssh redir ports %PORT
Chain POSTROUTING (policy ACCEPT)
num target prot opt source destination
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
Those are the global rules from iptables:
Chain INPUT (policy DROP)
num target prot opt source destination
1 f2b-dovecot-pop3imap tcp -- anywhere anywhere multiport dports pop3,imap2
2 f2b-sshd tcp -- anywhere anywhere multiport dports ssh
3 ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
4 ACCEPT all -- anywhere anywhere
5 ACCEPT icmp -- anywhere anywhere icmp echo-request
[... removed some mappings not related to this toppics (http-specific, some mail-ports)]
15 ACCEPT tcp -- anywhere anywhere tcp dpt:%REAL_SSH_PORT ctstate NEW,ESTABLISHED
Chain FORWARD (policy DROP)
num target prot opt source destination
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
Chain f2b-dovecot-pop3imap (1 references)
num target prot opt source destination
1 RETURN all -- anywhere anywhere
Chain f2b-sshd (1 references)
num target prot opt source destination
1 REJECT all -- XXXXXXX anywhere reject-with icmp-port-unreachable
2 REJECT all -- XXXXXXX anywhere reject-with icmp-port-unreachable
3 REJECT all -- XXXXXXX anywhere reject-with icmp-port-unreachable
4 REJECT all -- XXXXXXX anywhere reject-with icmp-port-unreachable
5 RETURN all -- anywhere anywhere
Some side-notes:
Choosing a different source port, like 99, will also not work
Using a local port forwarding rule like this works pretty fine when connecting from local machine
iptables -t nat -A OUTPUT -p tcp --dport 22 -j REDIRECT --to-port %PORT
What am I not seeing here?