How to add additional port for SSH access

[Alan9846]

Hi All,

We have a new customer that has an on-premise 3CX Server running V18 on Debian 10 (it was fresh installed as V18).

In order to get remote SSH access, we have requested a port forward to Port 22, but apparently that is already in use, and they can't forward, say, Port 22222 (external) to Port 22 on the 3CX Server (has to be the same port both sides).

I figured we would have the 3CX Server accept an SSH connection on both Port 22 and Port 22222, so we have added that additional port into /etc/ssh/sshd_config.

I have checked that the server is listening:

# ss -tlnp | grep -E "22|22222"

LISTEN    0         128                0.0.0.0:22222             0.0.0.0:*        users:(("sshd",pid=516,fd=3))                                                 

LISTEN    0         128                0.0.0.0:22               0.0.0.0:*        users:(("sshd",pid=516,fd=5))                                                 

LISTEN    0         128                   [::]:22222                [::]:*        users:(("sshd",pid=516,fd=4))                                                 

LISTEN    0         128                   [::]:22                  [::]:*        users:(("sshd",pid=516,fd=6))

However, I can't connect to Port 22222 using SSH, which I suspect is due to the NFTables Firewall, but I am not familiar with NFTables.


Question:

How can I add an additional 'rule' to NFTables to allow connections through to the SSH server?


Thanks,

Alan.

 

[Nathan@Voxtelesys]

Here is a rundown:

As root..
Create a backup: cp /etc/nftables.conf /root/nftables.backup
Make edits, save: nano /etc/nftables.conf
Check for syntax errors: nft -c -f /etc/nftables.conf
Apply the rules: systemctl restart nftables
Check that nftables service restarted and is running: systemctl status nftables

You should restart 3CX Services (or reboot) after applying NFT because 3CX services adds its own rules -- therefore you should probably do this after hours.

After "dport" you can specify a common port/package or the port with {XX}

Examples:

# SSH Bruteforce blacklist -- Commented to disable SSH from anywhere not whitelisted
# tcp dport ssh ct state new limit rate 15/minute accept comment "Avoid brute force on SSH"

# SSH Whitelist

ip saddr 1.1.1.1/32 ct state new tcp dport ssh counter packets 0 bytes 0 accept comment "Office"

ip saddr X.X.X.X ct state new tcp dport {22222} counter packets 0 bytes 0 accept comment "Accept SSH Port from specified IP"

tcp dport {22222} counter packets 0 bytes 0 accept comment "Accept SSH Port from everywhere with no rate limit"

tcp dport {22222} ct state new limit rate 15/minute accept comment "Accept custom SSH Port and avoid brute force on SSH"

You likely want something like the following, but keep in mind I have not tested this!
tcp dport {22222} ct state new limit rate 15/minute accept comment "Accept custom SSH Port and avoid brute force on SSH"

From our internal documentation:
To list rules:
nft list ruleset nft list table filter
To flush nftables:
nft flush ruleset
To reload nftables that are in /etc/nftables.conf:
systemctl restart nftables
To check the nftables for errors:
nft -c -f /etc/nftables.conf

To apply nft file to current ruleset:
nft -f nft_ruleset.nft
Over-write current ruleset to /etc/nftables.conf:
nft list ruleset > /etc/nftables.conf

 

[Alan9846]

Hi Nathan,

Brilliant - worked perfectly first time.


Thank you so much - I really appreciate it.

Alan.