1

I want to remotely access a Linux server in my private local LAN via HTTPS and SSH.

The server ist connected to my DSL router (German Fritz!Box). As I can't directly access my server because of this, I configured a NAT port forwarding to ports 443 and 22.

What I didn't consider was the drawbacks of NAT port forwarding: On my local server, I can only see the IP of my router as sender of each package.

I operate a small virtual Linux server, where I used fail2ban and some iptables rules to prevent some attacks (e.g. restrict the allowed IP addresses for connections to my country), and fail2ban automatically blocks IP addresses which had too many failed login attempts.

Because of NAT I can't do the same with my local server (or can I?). So what shall I do?

I thought about using my virtual server as a relay: Opening an SSH connection from my local server to my public vserver, and create two reverse SSH tunnels. The virtual server could then apply some firewall rules.

Is this a reasonable approach? Do you have some hints what else might make sense?

4
  • 2
    NAT should only be changing the destination IP of incoming packets, not the source IP. Something sounds fishy.
    – heavyd
    Jan 31, 2015 at 19:22
  • I agree, I've got a Linux SSH server behind a router/firewall performing NAT and I can block SSH connections on the actual source IP and the Linux server's log files show the originating IP address of systems, not the router's address as the source for connections. It sounds like a misconfiguration of the router if its IP address is seen as the source address.
    – moonpoint
    Jan 31, 2015 at 20:30
  • 1
    I had similar problems with some Fritz!Boxes, you could try setting you're server as DMZ host. On Frtiz!Box it's done the same way you do port forwarding but you have to select from the list 'Exposed host'. Just remember to set up you're firewall on destination machine since that will expose it to the Internet on nearly all ports (some ports for telephony may be used by Fritz!Box and accessible).
    – Enbyted
    Feb 1, 2015 at 9:10
  • @Enbyted that worked for me, thank you! Could you please create an answer from it, so I can accept it?
    – muffel
    Feb 1, 2015 at 9:50

1 Answer 1

1

In my experience with Fritz!Box devices I had similar problems with NAT in them. Some models seem to change the source address to their own LAN address.

You can try setting desired host as DMZ, to do this remove all port forwards for that host and then create new one, but you have to select from the list 'Exposed host'. Beware that this will redirect all ports to selected host, so remember to set up you're firewall on destination machine since that will expose it to the Internet on nearly all ports (some ports for integrated services in the device may be used by Fritz!Box internally, so not forwarded).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .