tunneling using SSH port 2222

[evgenie.daniel1]

helllo

i have cisco router 860 andit has two networks: WAN 132.66.x.x

LAN 10.10.10.x

VLAN1 10.10.10.10   also DHCP

every time i want to connect to the PC on the network 10.10.10.x via SSH on Router i want to make a tunnel using port 2222.

for example i am on the network 132.66.x.x opening SSH putty and type the router's ip 10.10.10.10  or 132.66.x.x . and then after i authenticates i want to get directly to the PC 10.10.10.84 . which command i should run on the router in order to do it.

[Georg Pauwen]

Hello,

for the public IP address you could use a NAT statement:

ip nat inside source static tcp 10.10.10.84 2222 132.66.x.x 2222

So if you connect to 132.66.x.x on port 2222, that will connect you to 10.10.10.84 on port 2222.

For the internalIP address, a TCL script might work. I'll check that...

[evgenie.daniel1]

thanks. but if i connect to 10.10.10.10 on port 2222 using SSH, that will connect me to 10.10.10.84 on port 2222  also  ?

[Georg Pauwen]

Hello,

no it won't. I am thinking that some sort of TCL script that redirects that IP address can be written, but I'll have to look into this...

[evgenie.daniel1]

first i want it:

[evgenie.daniel1]

So if i connect to my router ip 132.66.210.73 from the network 132.66.x.x on port 2222 using putty, that will connects me automatically to 10.10.10.84 PC  on port 22   because i added a nat command that you typed me ?

[evgenie.daniel1]

see my the show ip nat translation:

btw it did not worked.

[Georg Pauwen]

Hello,

this is what your NAT statement should look like:

ip nat inside source static tcp 10.10.10.84 22 132.66.210.72 2222

Do you have any access lists on your router ? Post the full config if possible...

[evgenie.daniel1]

i did it already and it did not worked. maybe i need to add access lists. here you go:

Building configuration...

Current configuration : 3880 bytes
!
! Last configuration change at 09:52:35 IST Thu Sep 28 2017 by intelwifi
! NVRAM config last updated at 09:53:53 IST Thu Sep 28 2017 by intelwifi
!
version 15.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec localtime
no service password-encryption
!
hostname responders-router
!
boot-start-marker
boot-end-marker
!
!
enable secret level 2 5 
enable secret 5 
enable password 
!
no aaa new-model
wan mode ethernet
clock timezone IST 2 0
clock summer-time IDT date Mar 27 2015 2:00 Oct 25 2015 2:00
!
!
!
!
ip dhcp excluded-address 10.10.10.10
!
ip dhcp pool intelwifi
import all
network 10.10.10.0 255.255.255.0
default-router 10.10.10.10
lease infinite
remember
!
!
!
!
no ip domain lookup
ip name-server 132.66.48.2
ip name-server 132.66.32.10
ip name-server 132.66.16.2
ip cef
no ipv6 cef
!
!
!
!
!
!
!
!
crypto pki trustpoint TP-self-signed-2542841576
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2542841576
revocation-check none
rsakeypair TP-self-signed-2542841576
!
!
crypto pki certificate chain TP-self-signed-2542841576
certificate self-signed 01
3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 32353432 38343135 3736301E 170D3137 30313035 31303232
33305A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 35343238
34313537 3630819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100CDB1 C3541EF3 7DDF1454 F2F22902 0432D636 CB786D6B 6BE7B41F 4279DEAB
BED5BEDE 21AAD5BE F43677D8 1362B3EC 2A4E29C8 1169D61F 2F3DD9EC 48B341C9
62E0C1A3 C33D3E64 3F0C1BDB 930447FE F36BDB74 DEE37E85 E612DC44 E297B0C4
C24943FB 7E7080CD 22997ED0 5B82D2A2 065CBF2B 87BE1B4E FCD23D81 019D7A80
FDEB0203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603
551D2304 18301680 142ED878 88BC59AF DD5CAC81 9F693807 64C852D4 7F301D06
03551D0E 04160414 2ED87888 BC59AFDD 5CAC819F 69380764 C852D47F 300D0609
2A864886 F70D0101 05050003 818100CC 632836CD CAAA737C C6A265A0 0D87EC18
69B8FB8B 4A68D0EA E5AA8D12 0B56698B 988AA9EC 976E42E2 61DEE245 A5D11810
FB61D41D 74A48D76 DF29B912 47E19D59 A4A39B9D 5F71A194 4229DB65 8842A324
59759F5D 304C2444 CB0C7445 1067C503 921D4091 3CF731E4 9A8E0529 0DBD9DE1
7435B5BB 8AEB7464 2D7CAF70 2194D0
quit
!
!
username intelwifi privilege 15 secret 5 
!
!
controller VDSL 0
!
ip ssh time-out 60
ip ssh source-interface GigabitEthernet0
ip ssh version 2
ip scp server enable
ip rcmd rcp-enable
ip rcmd rsh-enable
ip rcmd remote-host root 132.66.48.2 root enable
ip rcmd remote-host root 132.66.48.2 yosi enable
!
!
!
!
interface ATM0
no ip address
shutdown
no atm ilmi-keepalive
!
interface Ethernet0
no ip address
shutdown
!
interface FastEthernet0
no ip address
spanning-tree portfast
!
interface FastEthernet1
no ip address
spanning-tree portfast
!
interface FastEthernet2
no ip address
spanning-tree portfast
!
interface FastEthernet3
no ip address
spanning-tree portfast
!
interface GigabitEthernet0
ip address dhcp
duplex auto
speed auto
!
interface Vlan1
ip address 10.10.10.10 255.255.255.0
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
!

ip nat inside source static tcp 10.10.10.84 22 132.66.210.72 2222 extendable
ip route 0.0.0.0 0.0.0.0 dhcp
!
logging trap warnings
logging host 132.66.48.2
!
!
control-plane
!
!
!
line con 0
access-class 187 in
exec-timeout 30 0
login local
no modem enable
line aux 0
access-class 187 in
exec-timeout 30 0
login local
line vty 0 4
access-class 187 in
exec-timeout 30 0
privilege level 15
login local
transport input telnet ssh
!
scheduler allocate 60000 1000
ntp server 132.66.8.7
!
end

[Georg Pauwen]

The static NAT statement only works if you have the static IP address 132.66.210.72 assigned to your external interface.

interface GigabitEthernet0
ip address 132.66.210.72 255.255.x.x
duplex auto
speed auto

If you need to use DHCP on your external interface, the NAT statement needs to be:

ip nat inside source static tcp 10.10.10.84 22 interface GigabitEthernet0 2222 

[evgenie.daniel1]

i did it with dhcp and with static ip on the external interface. and added the ip nat .... and it still won't work. putty saying conection refused!

[Georg Pauwen]

Try and remove access-class 187 from all your VTY lines, it is an empty access list (doesn't exist)...

[evgenie.daniel1]

did what you have said. still "putty connection refused".(i tried with ssh port 2222 and with raw port 2222)

see the attachment of the show run:

[Georg Pauwen]

Hello,

is this router connected to the Internet ?

Either way, you have to add the below to your interfaces:

interface GigabitEthernet0

ip nat outside

interface Vlan10

ip nat inside

[evgenie.daniel1]

ok now there are some progress but stil stuck on the passpord:

see the attachments bellow: