This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Help with SSH forwarding

Hi,

I am trying to allow SSH through my astaro (using port 2223) to ServerA, but I want to only allow traffic from specific IP addresses.

I have defined several networks (I am trying to allow access to two different IP blocks of an external contractor)

I then defined a network group of these networks, called CompanyA

I also defined a service that has a source port of 2223 and a destination port of 2223, called ServiceA

I then configured a DNAT as such:

Traffic Selector: CompanyA ---> ServiceA ---> Wan (address)
Destination translation: ServerA ServiceA

ServerA is configured to use 2223 for SSH and this works on the internal network.

I am using an ASG 220 running firmware 8.103

Any help is greatly appreciated,

Billy

This thread was automatically locked due to age.

0 BarryG over 14 years ago

Hi, did you click on the "Automatic packetfilter rule" checkbox?

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 ITguy91 over 14 years ago in reply to BarryG

I have tried both with it checked and unchecked.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 14 years ago

Please 'Go Advanced' and add a picture of your DNAT.

Cheers - Bob
PS Don't bother - Dilandau read your original post closely enough to see the solution! It's a good habit to leave the 'Destination service' blank if not changing the service.
Cancel
Vote Up 0 Vote Down

Cancel
0 dilandau over 14 years ago

Normally the service definition should have a range for the source ex: 1:65535. You can check the packet filter log to check the source port of the dropped traffic to verify if it is using a range or just 2223 for the source port.
Cancel
Vote Up 0 Vote Down

Cancel
0 ITguy91 over 14 years ago in reply to dilandau

Thanks,

It was the port range issue. I edited the service source port to 1:65535, and it fixed the issue.

thanks again,

Billy
Cancel
Vote Up 0 Vote Down

Cancel