ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    Solved Route SSH to internal virtual network via centos7 vm router

    IT Discussion
    5
    20
    1.5k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      Kelly @VoodooRabbit87
      last edited by

      @voodoorabbit87 said in Route SSH to internal virtual network via centos7 vm router:

      @scottalanmiller the image up top is the physical router which has the vpn service running on it (DDWRT), that's the route table with NAT to 10.0.10.0 via the virtual external nic 10.0.0.20, ipv4 forwarding is enabled, nics have zones assigned (int/ext).

      i can ssh to the internal nic on the vm router 10.0.10.2, however i cannot ssh to the server 10.0.10.10 which sits behind this vm router, i just thought a rule needed adding to firewalld to allow ssh traffic through too, as pings already are.

      Can you ssh from an IP in the same subnet, i.e. traffic not crossing the router? This will allow you to eliminate the firewall on the host. Since traces and pings are working then you know your routing is correct. Depending on how your VPN is configured it may need a specific rule in the VPN settings to allow traffic instead of configuring it in the firewall settings (not familiar with the particulars of DDWRT).

      V 1 Reply Last reply Reply Quote 0
      • B
        black3dynamite
        last edited by

        What VPN are using on your DD-WRT? OpenVPN?

        V 1 Reply Last reply Reply Quote 0
        • V
          VoodooRabbit87 @black3dynamite
          last edited by

          @black3dynamite aye, with certs and the client on my work laptop.

          B 1 Reply Last reply Reply Quote 0
          • B
            black3dynamite @VoodooRabbit87
            last edited by

            @voodoorabbit87 said in Route SSH to internal virtual network via centos7 vm router:

            @black3dynamite aye, with certs and the client on my work laptop.

            I've only setup OpenVPN on pfSense with great success.

            On this website...
            https://www.howtogeek.com/64433/how-to-install-and-configure-openvpn-on-your-dd-wrt-router/

            Does your config looks somewhat similar this?
            0_1530889668766_screenshot_1.png

            What about your firewall rules?
            0_1530889677339_screenshot_2.png

            V 1 Reply Last reply Reply Quote 0
            • V
              VoodooRabbit87 @black3dynamite
              last edited by

              @black3dynamite so my config box looks exactly like what i posted in the OP, idk if its the cause of diff ddwrt builds but any extra settings i put in there caused the vpn service to fail to start so i left it minimal as it just worked.

              firewall looks like this

              iptables -I INPUT 1 -p tcp –dport 443 -j ACCEPT
iptables -I FORWARD 1 –source 10.0.1.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.0.1.0/24 -j MASQUERADE

              obvs 443 to bypass work fw.

              K 1 Reply Last reply Reply Quote 0
              • V
                VoodooRabbit87 @Kelly
                last edited by

                @kelly yes i can ssh from the vm router (10.0.10.2) to the server (10.0.10.10), basically same as another machine. i can ssh from my kvm host (10.0.0.10) to the server (10.0.10.10)

                1 Reply Last reply Reply Quote 0
                • K
                  Kelly @VoodooRabbit87
                  last edited by

                  @voodoorabbit87 said in Route SSH to internal virtual network via centos7 vm router:

                  @black3dynamite so my config box looks exactly like what i posted in the OP, idk if its the cause of diff ddwrt builds but any extra settings i put in there caused the vpn service to fail to start so i left it minimal as it just worked.

                  firewall looks like this

                  iptables -I INPUT 1 -p tcp –dport 443 -j ACCEPT
iptables -I FORWARD 1 –source 10.0.1.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.0.1.0/24 -j MASQUERADE

                  obvs 443 to bypass work fw.

                  You don't have an outbound rule. I'm not an iptables guru, but from what I've read it sounds like you need an explicit rule.

                  K 1 Reply Last reply Reply Quote 0
                  • K
                    Kelly @Kelly
                    last edited by

                    @kelly said in Route SSH to internal virtual network via centos7 vm router:

                    @voodoorabbit87 said in Route SSH to internal virtual network via centos7 vm router:

                    @black3dynamite so my config box looks exactly like what i posted in the OP, idk if its the cause of diff ddwrt builds but any extra settings i put in there caused the vpn service to fail to start so i left it minimal as it just worked.

                    firewall looks like this

                    iptables -I INPUT 1 -p tcp –dport 443 -j ACCEPT
iptables -I FORWARD 1 –source 10.0.1.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.0.1.0/24 -j MASQUERADE

                    obvs 443 to bypass work fw.

                    You don't have an outbound rule. I'm not an iptables guru, but from what I've read it sounds like you need an explicit rule.

                    Reference: https://unix.stackexchange.com/questions/136190/iptables-rule-to-allow-incoming-ssh-connections.

                    V 1 Reply Last reply Reply Quote 0
                    • V
                      VoodooRabbit87 @Kelly
                      last edited by

                      @kelly said in Route SSH to internal virtual network via centos7 vm router:

                      @kelly said in Route SSH to internal virtual network via centos7 vm router:

                      @voodoorabbit87 said in Route SSH to internal virtual network via centos7 vm router:

                      @black3dynamite so my config box looks exactly like what i posted in the OP, idk if its the cause of diff ddwrt builds but any extra settings i put in there caused the vpn service to fail to start so i left it minimal as it just worked.

                      firewall looks like this

                      iptables -I INPUT 1 -p tcp –dport 443 -j ACCEPT
iptables -I FORWARD 1 –source 10.0.1.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.0.1.0/24 -j MASQUERADE

                      obvs 443 to bypass work fw.

                      You don't have an outbound rule. I'm not an iptables guru, but from what I've read it sounds like you need an explicit rule.

                      Reference: https://unix.stackexchange.com/questions/136190/iptables-rule-to-allow-incoming-ssh-connections.

                      so i shutdown the firewall on the centos vm router and i was able to connect to the internal server.

                      definitely need to look into firewalld

                      1 Reply Last reply Reply Quote 0
                      • V
                        VoodooRabbit87
                        last edited by VoodooRabbit87

                        So to get this to work i needed to use this firewalld line:

                        firewall-cmd --permanent --direct --passthrough ipv4 -I FORWARD -i eth1 -j ACCEPT

                        eth1 is the external interface on the vm router.

                        does this effectively render the firewall pointless though?

                        travisdh1T 1 Reply Last reply Reply Quote 0
                        • travisdh1T
                          travisdh1 @VoodooRabbit87
                          last edited by travisdh1

                          @voodoorabbit87 said in Route SSH to internal virtual network via centos7 vm router

                          does this effectively render the firewall pointless though?

                          Yep. You need to do port forwarding too have an effective firewall.

                          I wouldn't recommend CentOS as a router. It can do the job, but was not designed for it.
                          I'v been using a VyOS software firewall for my home lab, which seems to do a very good job with few system resources needed. Plus it's used the same sort of command line environment that many hardware firewalls do, so I learned how to use many more things than just VyOS.

                          Edited for phone auto spell weirdness.

                          V 1 Reply Last reply Reply Quote 2
                          • V
                            VoodooRabbit87 @travisdh1
                            last edited by

                            @travisdh1 ahhh, i had a feeling that was going to be the answer :persevering_face:. Thanks tho, i'll definitely check this out!

                            1 Reply Last reply Reply Quote 1
                            • 1 / 1
                            • First post
                              Last post