Forward a host network traffic to another host with the exception of the ssh service

Winter asked:

I am trying to redirect all the network traffic received in a old host to a different new host. For that i created two new rules on iptables of the old host:

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -d old_machine_ip -j DNAT --to-destination new_machine_IP
iptables -t nat -A POSTROUTING -s new_machine_ip -j SNAT --to-source old_machine_ip
/etc/init.d/iptables save
/etc/init.d/iptables restart

Everything worked perfectly however i cannot access the old host ssh anymore since it redirect to the new host so i would like to know if it is possible to create a single rule that ignores the prerouting for the ssh service.

best regards,

My answer:

Just insert a rule to leave the chain when ssh traffic comes in. This should appear before your DNAT rules.

iptables -t nat -A PREROUTING -m tcp -p tcp --dport 22 -j RETURN

View the full question and answer on Server Fault.

Creative Commons License
This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.