I'm trying to get my tomato installation working with one address for the router (say 18.104.22.168) and two other public IP addresses for different servers on the LAN (say 22.214.171.124 and 126.96.36.199).
The problem is that ssh'ing in from outside works for one IP address (188.8.131.52) and not the other (184.108.40.206).
- I have followed the instructions in the setup-multiple-static-public-ips tutorial. (It won't let me post the actual link to it.)
- Here is my Firewall script: (addresses changed to protect the innocent)
/usr/sbin/ip addr add 220.127.116.11/24 dev vlan1 /usr/sbin/ip addr add 18.104.22.168/24 dev vlan1 /usr/sbin/iptables -t nat -I PREROUTING -d 22.214.171.124 -j DNAT --to-destination 192.168.1.26 /usr/sbin/iptables -t nat -I PREROUTING -d 126.96.36.199 -j DNAT --to-destination 192.168.1.30 /usr/sbin/iptables -I FORWARD -p tcp -d 192.168.1.26 --dport 22 -j ACCEPT /usr/sbin/iptables -I FORWARD -p tcp -d 192.168.1.30 --dport 22 -j ACCEPT /usr/sbin/iptables -t nat -I POSTROUTING 1 -p all -s 192.168.1.26 -j SNAT --to 188.8.131.52 /usr/sbin/iptables -t nat -I POSTROUTING 1 -p all -s 192.168.1.30 -j SNAT --to 184.108.40.206
- I can tell that the vlan is setup:
root@fw:/tmp/home/root# ip addr show vlan1 5: vlan1@eth0: <BROADCAST,MULTICAST,ALLMULTI,UP,10000> mtu 1500 qdisc noqueue link/ether 40:16:e7:5a:e5:30 brd ff:ff:ff:ff:ff:ff inet 220.127.116.11/24 scope global vlan1 inet 18.104.22.168/24 scope global secondary vlan1 root@fw:/tmp/home/root#
- I can tell that the iptables rules are in place for port 22:
root@fw:/tmp/home/root# iptables -L|egrep '192.168.1.30|192.168.1.26' ACCEPT tcp -- anywhere 192.168.1.30 tcp dpt:ssh ACCEPT tcp -- anywhere 192.168.1.26 tcp dpt:ssh root@fw:/tmp/home/root#
- The public IP addresses work fine because everything works if I swap in my old router.
- Similarly, the ssh servers work because it works fine with my old router.
- Nothing appears in the router log when the incoming ssh fails.
- My actual configuration has more forwarded ports besides ssh(22) and they also work for the one IP and not for the other.
- My hardware is an Asus RT-N66U and my tomato version is (shibby) tomato-K26USB-1.28.RT-N5x-MIPSR2-117-AIO-64K.
I sure would appreciate any insight into the problem.
— Jim —