Linux Networking Cookbook

3.12. Allowing Remote SSH Through a NAT Firewall

Problem

You want to open up remote SSH administration to your LAN so you can log in remotely and access various random LAN hosts. You have the OpenSSH server running on the machines you want to remotely administer, but there is a problem—they use nonroutable private IPs, so they are all source NAT-ed to the firewall IP address. How do you get past your NAT firewall?

Solution

The simplest method uses any of the SSH rules in the previous recipe (except, of course, the LAN-only rule) without requiring any changes. SSH into your firewall, then SSH from there into whatever LAN hosts you need to get into. Your sessions will look like this example, which demonstrates logging from a remote host into the firewall named windbag, and then opening an SSH session from windbag to stinkpad:

	carla@remotehost:~$ ssh windbag.foo.net
	[e-mail]'s password:
	Linux windbag 2.6.12-10-386 #1 Mon Sep 28 12:13:15 UTC 2007 i686 GNU/Linux
	Last login: Mon Aug 21 17:07:24 2007 from foo-29.isp.net
	carla@windbag:~$ ssh stinkpad
	carla@stinkpad's password:
	Last login: Mon Sep 21 17:08:50 2007 from windbag.foo.net
	[carla@stinkpad ~]$

Using this method avoids the problem of having to write additional iptables rules.

What if you have users who need remote SSH access to their PCs, and you deem them worthy enough to have it? To use the two-step SSH login, they will need user accounts on the firewall, which you may not want to allow. To avoid this, you can set up ...