blob: 0355227da2d68c25b109498c1ce7cc92ada82273 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
|
sshuttle -v -N -r cstaps@lilo.science.ru.nl:22
# Generated by iptables-save v1.4.21 on Fri Oct 2 10:27:40 2015
*mangle
:PREROUTING ACCEPT [6102:3735715]
:INPUT ACCEPT [6102:3735715]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [6093:1035805]
:POSTROUTING ACCEPT [6219:1052137]
COMMIT
# Completed on Fri Oct 2 10:27:40 2015
# Generated by iptables-save v1.4.21 on Fri Oct 2 10:27:40 2015
*filter
:INPUT DROP [196:17078]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [3806:688407]
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 5 -j DROP
-A FORWARD -p icmp -j ACCEPT
-A FORWARD -p icmp -m icmp --icmp-type 5 -j DROP
-A OUTPUT -p icmp -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 5 -j DROP
COMMIT
# Completed on Fri Oct 2 10:27:40 2015
# Generated by iptables-save v1.4.21 on Fri Oct 2 10:27:40 2015
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [4:246]
:POSTROUTING ACCEPT [4:246]
:sshuttle-12300 - [0:0]
-A PREROUTING -j sshuttle-12300
-A OUTPUT -j sshuttle-12300
-A sshuttle-12300 -d 131.174.30.0/24 -p tcp -m ttl ! --ttl-eq 42 -j REDIRECT --to-ports 12300
-A sshuttle-12300 -d 169.254.0.0/16 -p tcp -m ttl ! --ttl-eq 42 -j REDIRECT --to-ports 12300
-A sshuttle-12300 -d 127.0.0.0/8 -p tcp -j RETURN
COMMIT
# Completed on Fri Oct 2 10:27:40 2015
The filter table is still there from exercise 1.
The nat table (1) accepts everything, (2) handles prerouting and outgoing traffic with 'sshuttle-12300', (3) which sends it to port 12300, where the SSHuttle server is running. (4) by setting a max. TTL we don't allow loops.
|
