Nftables nat

DNAT zum client

Rausfinden der MAC Adresse

• tail -f /var/lib/kea/kea-leases4.csv

172.26.213.50,08:00:27:e8:73:76,01:08:00:27:e8:73:76,7200,1785495333,1,0,0,client,0,,0

Zuerst dem Client über dhcp eine feste IP zu teilen

• cat /etc/kea/kea-dhcp4.conf

         { "hw-address": "aa:bb:cc:dd:ee:ff", "ip-address": "172.26.2XX.10", "hostname": "client" } 

ersetzen

         { "hw-address": "08:00:27:e8:73:76", "ip-address": "172.26.2XX.10", "hostname": "client" }  

Neustart nicht vergessen

• systemctl restart kea-dhcp4-server.service

Man soll über den port 9922 und der äusseren Ip der Firewall per ssh auf den Client auf Port 22 zugreifen

 define CLIENT = 172.26.2XX.10

table inet filter {
   ....
   chain forward {
   type filter hook forward priority filter; policy drop;
   ct state established,related accept
   ...
    ct state new iif $WANDEV oif $LANDEV ip daddr $CLIENT tcp dport 22 accept
   log prefix "--nftables-drop-forward--"

}

table inet nat {
    chain prerouting {
        type nat hook prerouting priority dstnat; policy accept;
        ip daddr $WANIP tcp dport 9922 dnat ip to $CLIENT:22
      }