I have configured an SSH tunnel on my DD-WRT router using the default port 22.

I would like to open another port on my router as a proxy port for SSH, say port 80, in case a firewall prevents me from connecting to port 22. How do I do this? I assume it may be a combination of configuring SSH TCP Forwarding (which I have left set "OFF" because I still can't find that it does anything when on), Port Forward (which I have set to forward TCP 80 to, and iptables (which I have not modified because I only topically understand them).

At present, I can access the SSH tunnel using port 22. If I scan port 80, it shows open, but I cannot establish an SSH connection over it. I'm guessing my firewall is the issue.

Can someone answer how I should configure the router, using the GUI as much as possible, to proxy port 80 to 22 on localhost?

My configuration: DD-WRTv24-sp2, Build 14896

Current iptables configuration:

# OpenVPN
iptables -I INPUT 1 -p tcp --dport 1194 -j ACCEPT
iptables -I FORWARD 1 --source -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT

# Force-Filter DNS
iptables -t nat -A PREROUTING -i br0 -p udp --dport 53 -j DNAT --to $(nvram get lan_ipaddr)
iptables -t nat -A PREROUTING -i br0 -p tcp --dport 53 -j DNAT --to $(nvram get lan_ipaddr)
  • Could an administrator explain why my post was migrated from server fault? Serverfault has far more a following for my tags than superuser. – Brandon Lebedev Jan 1 '15 at 16:22
  • Yes, I can. dd-wrt is an end-user/consumer networking system, making this a consumer/end-user question which is off-topic on Server Fault. – Sven Jan 1 '15 at 18:05

I assume you want to open port 80 on the 'Internet' side to be forwarded to port 22 of a server on the 'LAN' side?

I'm not sure how to do that on DD-WRT, but I think you should do it in two steps:

  1. Configure the DD-WRT to do "Port Forward" on ports 80 and 22 to the target server

  2. Configure SSH on the target server to listen on ports 22 and 80.

| improve this answer | |

In Administration > Commands, add the following line to the firewall configuration:

iptables -t nat -I PREROUTING -p tcp -d $(nvram get wan_ipaddr) --dport 80 -j DNAT --to $(nvram get lan_ipaddr):22
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.