SSH tunneling IP filtering

Question

I have created this tunnel on server 10.1.1.1: ssh -f -N -o -L 8789:10.2.2.2:22 user@10.2.2.2

This allows me to connect from local server to the remote server, through port 8789, like so : ssh -p 8789 user@localhost

What I want to achieve, is to let also other servers, to connect to remote server 10.2.2.2 through that port, so I came with this :

ssh -f -N -o -L 10.1.1.1:8789:10.2.2.2:22 user@10.2.2.2

This way, other servers , like 10.1.1.2 or 10.1.1.3 ( who are able to ssh into 10.1.1.1) , can connect to 10.2.2.2 through the tunnel:

ssh -p 8789 user@10.1.1.1

The problem is that this way, everyone who has access to 10.1.1.1 can use that tunnel, and I don't want that. Let's say I only want 10.1.1.2 and 10.1.1.3 to be able to use that tunnel. How do I achieve this ? Thanks.

Answer 1

This can be done with firewall rules. For example , Iptables. First we allow the traffic on a specific IP:

iptables -A IN_public_allow -s a.b.c.d -p tcp -m tcp --dport abcd -m conntrack --ctstate NEW -j ACCEPT

Then the whole traffic is restricted on the port:

iptables -A IN_public_allow -p tcp -m tcp --dport abcd -m conntrack --ctstate NEW -j DROP

This way, everyone is blocked on the port, except ip a.b.c.d.