1

I want to remotely access a Linux server in my private local LAN via HTTPS and SSH.

The server ist connected to my DSL router (German Fritz!Box). As I can't directly access my server because of this, I configured a NAT port forwarding to ports 443 and 22.

What I didn't consider was the drawbacks of NAT port forwarding: On my local server, I can only see the IP of my router as sender of each package.

I operate a small virtual Linux server, where I used fail2ban and some iptables rules to prevent some attacks (e.g. restrict the allowed IP addresses for connections to my country), and fail2ban automatically blocks IP addresses which had too many failed login attempts.

Because of NAT I can't do the same with my local server (or can I?). So what shall I do?

I thought about using my virtual server as a relay: Opening an SSH connection from my local server to my public vserver, and create two reverse SSH tunnels. The virtual server could then apply some firewall rules.

Is this a reasonable approach? Do you have some hints what else might make sense?

  • 2
    NAT should only be changing the destination IP of incoming packets, not the source IP. Something sounds fishy. – heavyd Jan 31 '15 at 19:22
  • I agree, I've got a Linux SSH server behind a router/firewall performing NAT and I can block SSH connections on the actual source IP and the Linux server's log files show the originating IP address of systems, not the router's address as the source for connections. It sounds like a misconfiguration of the router if its IP address is seen as the source address. – moonpoint Jan 31 '15 at 20:30
  • 1
    I had similar problems with some Fritz!Boxes, you could try setting you're server as DMZ host. On Frtiz!Box it's done the same way you do port forwarding but you have to select from the list 'Exposed host'. Just remember to set up you're firewall on destination machine since that will expose it to the Internet on nearly all ports (some ports for telephony may be used by Fritz!Box and accessible). – Enbyted Feb 1 '15 at 9:10
  • @Enbyted that worked for me, thank you! Could you please create an answer from it, so I can accept it? – muffel Feb 1 '15 at 9:50
1

In my experience with Fritz!Box devices I had similar problems with NAT in them. Some models seem to change the source address to their own LAN address.

You can try setting desired host as DMZ, to do this remove all port forwards for that host and then create new one, but you have to select from the list 'Exposed host'. Beware that this will redirect all ports to selected host, so remember to set up you're firewall on destination machine since that will expose it to the Internet on nearly all ports (some ports for integrated services in the device may be used by Fritz!Box internally, so not forwarded).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.