iptables regras de firewall que não permitem ssh de lan para DMZ

Question

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
REJECT     tcp  --  anywhere             anywhere            tcp dpt:www reject-with tcp-reset 
REJECT     tcp  --  anywhere             anywhere            tcp dpt:telnet reject-with tcp-reset 
ACCEPT     0    --  anywhere             anywhere            state RELATED,ESTABLISHED 
DROP       udp  --  anywhere             anywhere            udp dpt:route 
DROP       udp  --  anywhere             anywhere            udp dpt:route 
ACCEPT     udp  --  anywhere             anywhere            udp dpt:route 
logdrop    icmp --  anywhere             anywhere            
logdrop    igmp --  anywhere             anywhere            
ACCEPT     udp  --  anywhere             anywhere            udp dpt:5060 
ACCEPT     0    --  anywhere             anywhere            state NEW 
logaccept  0    --  anywhere             anywhere            state NEW 
ACCEPT     0    --  anywhere             anywhere            
ACCEPT     0    --  anywhere             anywhere            
ACCEPT     0    --  anywhere             anywhere            
logdrop    0    --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     0    --  192.168.0.0/24       192.168.2.0/24      reject-with icmp-port-unreachable 
ACCEPT     tcp  --  choister             192.168.2.142       tcp dpt:ssh state NEW 
REJECT     0    --  192.168.0.0/24       192.168.3.0/24      reject-with icmp-port-unreachable 
ACCEPT     gre  --  192.168.1.0/24       anywhere            
ACCEPT     tcp  --  192.168.1.0/24       anywhere            tcp dpt:1723 
ACCEPT     0    --  anywhere             anywhere            
ACCEPT     0    --  anywhere             anywhere            
ACCEPT     0    --  anywhere             anywhere            
ACCEPT     0    --  anywhere             anywhere            
TCPMSS     tcp  --  anywhere             anywhere            tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU 
lan2wan    0    --  anywhere             anywhere            
ACCEPT     0    --  anywhere             anywhere            state RELATED,ESTABLISHED 
logaccept  tcp  --  anywhere             choister            tcp dpt:www 
TRIGGER    0    --  anywhere             anywhere            TRIGGER type:in match:0 relate:0 
trigger_out  0    --  anywhere             anywhere            
logaccept  0    --  anywhere             anywhere            state NEW 
logdrop    0    --  anywhere             anywhere            

O servidor ssh ao qual estou tentando se conectar está na DMZ (192.168.0.145). É usado principalmente como um servidor da web. Eu preciso de acesso a ele do meu quarto 192.168.2.142. Eu não entendo porque o ssh não pode encaminhar para a sub-rede 192.168.2.0? Tenho certeza que é a regra de rejeição que causa isso porque funciona sem ele.

    

Answer 1

Acho que você quis dizer com essa regra:
 ACCEPT tcp - escolha 192.168.2.142 tcp dpt: ssh
ter 2.142 como a fonte e não o destino ...