Requirement 1: Previously, we introduced how to access an internal RDS database via a public IP proxy on Windows. This article explains how to achieve the same on Linux.
Requirement 2: Some customers have internal servers that need to access the internet through a public server (SNAT/VPN/PROXY).
In a standard network environment, these requirements are easily met by enabling
net.ipv4.ip_forward.Requirement 1:
Execute the following iptables command on the public server:
iptables -t nat -I PREROUTING -p tcp --dport 3306 -j DNAT --to RDSIP:3306This allows traffic destined for port 3306 on the public IP to be forwarded to port 3306 on the RDS IP.
Requirement 2:
Execute the following iptables command on the public server:
iptables -t nat -I POSTROUTING -s LANIP -j SNAT --to WANIPSet the gateway of the internal server to the internal IP of the public server. This will translate outgoing requests to use the WAN IP.
————
Due to restrictions in Alibaba Cloud’s virtualized network, the above methods may not always work. Therefore, here is a reliable application-layer solution using SSH tunnels:
Requirement 1:
[root@test ~]# ssh -Nf -L 122.224.103.234:3433:192.168.131.51:1433 192.168.131.219
Alternatively, configure
GatewayPorts yes in sshd_config and then execute:ssh -Nf -R 122.224.103.234:3433:192.168.1.51:1433 192.168.1.219
This enables access to port 3433 on the .234 server, which will be routed through the internal IP :219 to reach port 1433 on the internal server .51.
The internal IP :219 can be the internal IP of the public VM itself, or it can be a jump host accessible by both the public VM and the internal server.
Note:
If you want port 3433 to listen on all local IPs (0.0.0.0), set
gatewayports yes in sshd_config.-N tells the SSH client not to execute any remote commands; it only performs port forwarding.
-f tells the SSH client to run in the background. (After using this command, the SSH tunnel will continue listening in the background and won’t terminate if the terminal closes.)
Requirement 2
After enabling gatewayports, run the following command:
[root@test ~]# ssh -Nf -D 0.0.0.0:1080 122.224.103.234
This starts a SOCKS5 proxy on port 1080. Any program on the internal server that supports the SOCKS5 protocol can now access the internet via the public server proxy.