1

In my lab I want to set up a ssh jump host that forwards incoming ssh connections to Android devices that are connected to it via USB. All Android devices have USB-tethering turned on. The tethering connection spawns a network adapter in the sub net 192.168.42.0/24 for each Android device. Every Android device runs a ssh server on a different port. The setup is illustrated in the following:

enter image description here

My idea is to forward ssh connections according to the port. Therefore, I added the network adapters to a bridge and forwarded the connections via iptables. I made up the following for this purpose:

sudo ip link add name ogt type bridge
sudo ip l set eno1 master ogt 
sudo ip l set usb0 master ogt 
sudo ip l set usb1 master ogt
sudo ip a a 192.168.42.1/24 dev ogt
sudo ip link set ogt up

sudo iptables -t nat -A POSTROUTING -o ogt -j MASQUERADE
sudo iptables -t nat -A POSTROUTING ! -d 192.168.42.0/24 -o eno1 -j SNAT --to-source 172.16.1.100
echo 1 > /proc/sys/net/ipv4/ip_forward

sudo iptables -A PREROUTING -t nat -i eno1 -p tcp --dport 130 -j DNAT --to 192.168.42.130:130
sudo iptables -A FORWARD -p tcp -d 192.168.42.130 --dport 130 -j ACCEPT

sudo iptables -A PREROUTING -t nat -i eno1 -p tcp --dport 131 -j DNAT --to 192.168.42.131:131
sudo iptables -A FORWARD -p tcp -d 192.168.42.131 --dport 130 -j ACCEPT

The setup works but I have no internet on the jump host. Unfortunately, I do not quite understand why. How can I improve the forwarding or is there maybe a better solution? I would be very happy to have a helping hand. Thanks in advance!

4
  • 1
    Forwarding TCP ports to an Android device connected via USB you should use adb forward instead if iptables (requires to activate ADB on each device). The USB connection to the Android device is not detected as network connection, thus iptables will not help you in this situation.
    – Robert
    Mar 5, 2021 at 11:04
  • Thanks for your answer! adb forward seems to be exactly what I am looking for, I will give it a shot. You are right that the USB connection itself is not recognized as network adapter on the host computer. Activating tethering spawns a network adapter to establish a TCP/IP connection to the Android device in order to share the internet connection.
    – ninjab3s
    Mar 5, 2021 at 14:43
  • You have an incoming ssh connection - just use the ssh port forwarding feature to expose the adb ports on localhost.
    – Robert
    Mar 5, 2021 at 16:39
  • I just realized that I made a mistake in the sketch. The incoming connection is not on port 22, it is on port 130 or 131 depending on the device I want to connect to. I was able to get everything working, thanks for your answer Robert!
    – ninjab3s
    Mar 5, 2021 at 17:03

1 Answer 1

0

After a little while I got it working. Instead of iptables I use adb forward as suggested by Robert.

Therefore, start adb so that it listens on all local interfaces:

sudo adb -a nodaemon server start

The -a option makes adb listen on all local interfaces. Start adb without it if you only want to work locally.

Afterwards use adb forward to forward incoming ssh connections to the respective port on the Android device:

adb -s [serialDevice#1] forward tcp:130 tcp:130
adb -s [serialDevice#2] forward tcp:131 tcp:131

This forwards incoming connections on port 130/131 to the respective Android device. Using ssh [email protected] -p130 or ssh [email protected] -p131 I can now connect to the desired device

Here are some resources I used to research about this problem:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .