Saturday, August 19, 2017

How to redirect all traffic except SSH to one local port with iptables


Host OS: Ubuntu 16.06 LTS
I have my server listening on port 1233. I have to redirect my all TCP and UDP traffic to port 1233 except the SSH port. I successfully redirected my all ports to 1233 with the following IPTable rules.


*filter
:INPUT ACCEPT [89:12442]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [114:10536]
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
COMMIT
*nat
:PREROUTING ACCEPT [2:64]
:INPUT ACCEPT [2:261]
:OUTPUT ACCEPT [8:524]
:POSTROUTING ACCEPT [8:524]
-A PREROUTING -p tcp -m tcp -j REDIRECT --to-ports 1233
-A PREROUTING -p udp -j REDIRECT --to-ports 1233
COMMIT

I have also added a rule for the SSH port, but I could not successfully establish an SSH connection with my server because PREROUTING chains will execute first. After searching, I found a lot of questions that look related to this, but not a single one covered this scenario.


You might be wondering about the use case of this type of implementation. It's a honeypot server and our idea is to set up the honeypot to listen for all traffic except SSH. I know I could define a range of ports or use the multiport facility of iptables, but I have to redirect my all ports except 22.


Answer



My SSH was server listen at port 22. I got success with the following IPTables rules.


iptables -t nat -A PREROUTING -p tcp --dport 1:21 -j REDIRECT --to-port 5000
iptables -t nat -A PREROUTING -p tcp --dport 23:65389 -j REDIRECT --to-port 5000
iptables -t nat -A PREROUTING -p udp -j REDIRECT --to-port 5000
service iptables-persistent save
service iptables-persistent reload


No comments:

Post a Comment

hard drive - Leaving bad sectors in unformatted partition?

Laptop was acting really weird, and copy and seek times were really slow, so I decided to scan the hard drive surface. I have a couple hundr...