| View previous topic :: View next topic |
| Author |
Message |
Robert S
Guru
Joined: 15 Aug 2004
Posts: 463
Location: Canberra Australia
|
 Posted: Sun May 11, 2008 10:26 am Post subject: iptables: how do I redirect port 22 to another port? |
 |
|
I'm getting huge numbers of attempted logins through port 22. How do I change the port using iptables? I am using NAT at present. I have tried the following:
| Code: | | iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 2222 -j REDIRECT --to-ports 22 |
but it is possible to log in remotely through port 22 AND port 2222 (2222 is a hypothetical port).
I have a number of iptables rules to block failed login attempts (eg. recent module, app-admin/sshguard) and I don't want to interfere with the function of these if possible.
How do I set this up so logins through port 22 are blocked? |
|
| Back to top |
|
 |
bunder
Bodhisattva
Joined: 10 Apr 2004
Posts: 5947
|
| Posted: Sun May 11, 2008 10:43 am Post subject: |
|
|
| Quote: | | How do I set this up so logins through port 22 are blocked? |
you can tell the router to forward 2222 (outside) to 22 (inside)... any request coming to 22 (outside) should get dropped as it's not forwarded to anything on the inside. (ie: drop the 22->22 rule and replace it with 2222->22)
cheers
_________________
| Neddyseagoon wrote: | | The problem with leaving is that you can only do it once and it reduces your influence. |
banned from #gentoo since sept 2017 |
|
| Back to top |
|
|
manaka
Apprentice
Joined: 23 Jul 2007
Posts: 178
Location: Spain
|
| Posted: Mon May 12, 2008 6:00 pm Post subject: |
|
|
You can try something like this... The example uses DNAT as target (a personal choice). But should work just fine with REDIRECT...
| Code: |
# Connections to port 22 are dropped ;-)
iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 22 -j DROP
# Connections to port 2222 are redirected to port 22 ;-)
iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 2222 -j DNAT --to :22
# Connections to port 22 are accepted
# This rule is tried *after* NAT prerouting, so you are actually accepting connections to
# the original 2222 port ;-)
iptables -t filter -A INPUT -i ppp0 -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
|
_________________
Javier Miqueleiz
"Listen to your heart. It knows all things, because it came from the Soul of the World, and it will one day return there." |
|
| Back to top |
|
|
|
Networking & Security
