Here is a stripped-down set of rules that I have just tested.  These
came from a larger script I use on my firewall.  I forward ssh to an
internal system for logins.

#First shut down all traffic
/sbin/ipchains -P forward DENY

#Let all inside traffic get out
/sbin/ipchains -A forward -j MASQ -s 192.168.1.0/24 -d 0.0.0.0/0

#Forward ssh to login box
/usr/sbin/ipmasqadm portfw -a -P tcp -L x.x.x.x 22 -R 192.168.1.100 22 

# x.x.x.x = external firewall ip

Are you perhaps using tcp wrappers or have you configured AllowHosts or
DenyHosts in sshd_config on the box you're forwarding to?  Port
forwarding doesn't mask the ip from the external connection.

Larry


Mike Starke wrote:
> 
> Tried it......I am not having fun.
> 
> It appears (don't quote me on this) that it is definitly
> the port forwarding. I can ssh into my linux box, but beyond that
> is not working.
> 
> I even tried:
> ipchains -P input ACCEPT
> ipchains -P forward ACCEPT
> ipchains -A forward -s 192.168.10.0/24 -j MASQ
> ipmasqadm portfw -a -P tcp -L 192.168.10.2 22 -R 192.168.2.200 22
> 
> Just to see if I can redirect ssh to another linux box inside: No Luck.
> It just hangs.
> 
> Anyone have any idea what I can do?
> 
> Mike
> mgcon@getnet.com
> http://www.getnet.com/~mgcon
> Phoenix, AZ
> USA
> 
> On Tue, 31 Oct 2000, Patrick E. Stoddard wrote:
> 
> > Hi.
> >
> > Here is a possible alternative for making ipmasqadm pass
> > connections to that Citrix box behind your Linux box:
> >
> > ipmasqadm autofw -A -r tcp 1494 1494 -h 192.168.2.243
> >
> > and I think you can put the -L on there to log connections
> > as well.  I just had to do this for a friend with a W2K
> > Terminal Server behind his firewall at his house, and for
> > that I also had to do another line similar to above but
> > passing connections on TCP port 3389 to the same IP.
> >
> > With that, just make your client try to connect to your
> > Citrix box (192.168.10.2) and that should pass through
> > the Linux box just fine.
> >
> >
> > Good luck!   Patrick
> >
> > --
> > Patrick E. Stoddard           E-mail: wd9ewk at amsat dot org
> > Glendale, Arizona, USA        ICBM:   33.5 N 112.2 W
> >
> >    Also: wd9ewk at yahoo dot com - wd9ewk at arrl dot net
> >
> 
> ________________________________________________
> See http://PLUG.phoenix.az.us/navigator-mail.shtml if your mail doesn't post to the list quickly and you use Netscape to write mail.
> 
> Plug-discuss mailing list  -  Plug-discuss@lists.PLUG.phoenix.az.us
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

-- 
Provoke not your SA to anger, for he is a jealous SA, vengeful,
keeper of root, and quick to wrath.

Larry