Join Log in
Score:0
average_coder25 avatar Server

How to do port forwarding for GNS3 server (SSH tunneling)?

kr flag
average_coder25

I have a GNS3 server, and I'm trying to add iptable rules so that when someone on my team connects on port 1100, they get routed to an internal IP such as 192.168.122.2:22. This internal IP belongs to a bastion host of a GNS3 project. The end goal is to be able to shh into the internal IP addresses from a local machine.

This is how my IPTABLE looks (using fake public IP 1.2.3.4 for sake of example):

Chain PREROUTING (policy ACCEPT)
num  target     prot opt source               destination         
1    DNAT       tcp  --  0.0.0.0/0            1.2.3.4       tcp dpt:1100 to:192.168.122.2:22

Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
num  target     prot opt source               destination         
1    MASQUERADE  all  --  0.0.0.0/0            0.0.0.0/0          

Chain DOCKER (0 references)
num  target     prot opt source               destination         

Chain LIBVIRT_PRT (0 references)
num  target     prot opt source               destination

From my local machine, I execute the command ssh ubunut@1.2.3.4 -p1100. Ubuntu is the username needed to access the GNS3 project internal IP.

After executing this command, I get the following output on the GNS3 server (1.2.3.4): cloud@gns3:~$ connect_to 192.168.122.2 port 1100: failed.

Seems like my SSH command is reaching the GNS3 server, and attempts to do a port forwarding. However, it's attempting to forward to port 1100 instead of 22 for some reason? Can anyone identify why?

Here's what I tried to far:

  1. Set ipv4 port forwarding to 1
  2. set GatewayPorts and AllowTcpForwarding to 1 in
  3. ran on local machine (I think this changed some configs on the server) - ssh -R 1.2.3.4:1100:192.168.122.2:22 cloud@1.2.3.4
  4. Added rule to IPtables using command sudo iptables --table nat --append PREROUTING --protocol tcp --destination 1.2.3.4 --dport 1100 --jump DNAT --to-destination 192.168.122.2:22
  5. Also added Masquerading: sudo /sbin/iptables -t nat -A POSTROUTING -j MASQUERADE
199
1 + 0
ssh
Score:0
avatar Server
cn flag
fswings

Instead of using DNAT, it should be REDIRECT according to this source:

https://fabianlee.org/2018/09/17/iptables-running-service-as-non-root-iptables-to-forward-from-privileged-port/

So:

sudo iptables --table nat --append PREROUTING --protocol tcp --destination 1.2.3.4 --dport 1100 --jump REDIRECT --to-destination 192.168.122.2:22
0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.