qs-firewall:/root # iptables -t nat --list | grep ssh
NFLOG tcp -- anywhere qs-firewall tcp spts:tcpmux:65535 dpt:ssh LOGMARK match 60021
DNAT tcp -- anywhere qs-firewall tcp spts:tcpmux:65535 dpt:ssh to:192.168.50.2:22
NFLOG tcp -- anywhere qs-firewall tcp spts:tcpmux:65535 dpt:ssh LOGMARK match 60021
DNAT tcp -- anywhere qs-firewall tcp spts:tcpmux:65535 dpt:ssh to:192.168.50.2:22
qs-firewall:/root # iptables --list | grep ssh
CONFIRMED tcp -- anywhere 192.168.50.2 tcp spts:tcpmux:65535 dpt:ssh ctorigdst qs-firewall
CONFIRMED tcp -- 192.168.50.0/24 anywhere tcp spts:tcpmux:65535 multiport dports ms-wbt-server,5900,ms-wbt-server,5900,ssh,telnet,ica
CONFIRMED tcp -- 192.168.50.0/24 10.0.0.0/24 tcp spts:tcpmux:65535 dpt:ssh
CONFIRMED tcp -- 10.0.0.0/24 anywhere tcp spts:tcpmux:65535 multiport dports smtps,imaps,http-alt,rsync,http,jabber-client,imap,ndl-aas,https,ssh,ftp,smtp
qs-firewall:/root #
I'm able to connect to the 192.168.50.2 through the public IP across DNAT with SSH. I am not able to connect to the SSH service by internal IP through the VPN. The box is able to be pinged.
dskillin@gitidev ~ $ ping 192.168.50.2 -c 5
PING 192.168.50.2 (192.168.50.2) 56(84) bytes of data.
64 bytes from 192.168.50.2: icmp_seq=1 ttl=61 time=32.3 ms
64 bytes from 192.168.50.2: icmp_seq=2 ttl=61 time=70.5 ms
64 bytes from 192.168.50.2: icmp_seq=3 ttl=61 time=33.1 ms
64 bytes from 192.168.50.2: icmp_seq=4 ttl=61 time=76.2 ms
64 bytes from 192.168.50.2: icmp_seq=5 ttl=61 time=33.9 ms
--- 192.168.50.2 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4020ms
rtt min/avg/max/mdev = 32.338/49.254/76.274/19.815 ms
Traceroute shows the route is known.
dskillin@gitidev ~ $ sudo traceroute 192.168.50.2
traceroute to 192.168.50.2 (192.168.50.2), 30 hops max, 38 byte packets
1 192.168.210.1 (192.168.210.1) 0.810 ms 0.396 ms 1.462 ms
2 firewall (192.168.254.254) 0.936 ms 0.983 ms 1.461 ms
3 10.242.2.6 (10.242.2.6) 35.307 ms 35.144 ms 35.811 ms
4 192.168.50.2 (192.168.50.2) 31.743 ms 33.179 ms *
Pings work in the opposite direction as well.
dskillin@optimus ~ $ ping 192.168.210.8 -c 5
PING 192.168.210.8 (192.168.210.8) 56(84) bytes of data.
64 bytes from 192.168.210.8: icmp_seq=1 ttl=61 time=32.0 ms
64 bytes from 192.168.210.8: icmp_seq=2 ttl=61 time=32.6 ms
64 bytes from 192.168.210.8: icmp_seq=3 ttl=61 time=36.5 ms
64 bytes from 192.168.210.8: icmp_seq=4 ttl=61 time=33.1 ms
64 bytes from 192.168.210.8: icmp_seq=5 ttl=61 time=34.4 ms
--- 192.168.210.8 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4010ms
rtt min/avg/max/mdev = 32.015/33.775/36.581/1.620 ms
Packets are dropped in the packet filter.
21:17:16 Default DROP TCP
192.168.210.8 : 40655
→
192.168.50.2 : 22
[SYN] len=60 ttl=61 tos=0x00 srcmac=0:c:29:ac:a6:50
21:17:19 Default DROP TCP
192.168.210.8 : 40655
→
192.168.50.2 : 22
[SYN] len=60 ttl=61 tos=0x00 srcmac=0:c:29:ac:a6:50
Automatic packet filter rules are established for the link.
Client side 10.0.0.0/24 & 192.168.50.0/24
Server side 192.168.100.0/24, 192.168.210.0/24, 192.168.251.0/24, & 192.168.120.0/24
This works in previous stable versions.
SSH is enabled on the Astaro, using an alternate port.
