netdev - Re: VRF: ssh port forwarding between non-vrf and vrf interface.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2dbd0ccb-9209-5682-0ae2-207cc02086ab@gmail.com>
Date:   Fri, 22 Jan 2021 09:02:25 -0700
From:   David Ahern <dsahern@...il.com>
To:     Ben Greear <greearb@...delatech.com>,
        netdev <netdev@...r.kernel.org>
Subject: Re: VRF: ssh port forwarding between non-vrf and vrf interface.

On 1/22/21 8:45 AM, Ben Greear wrote:
> Hello,
> 
> I have a system with a management interface that is not in any VRF, and
> then I have
> a port that *is* in a VRF.  I'd like to be able to set up ssh port
> forwarding so that
> when I log into the system on the management interface it will
> automatically forward to
> an IP accessible through the VRF interface.
> 
> Is there a way to do such a thing?
> 

For a while I had a system setup with eth0 in a management VRF and setup
to do NAT and port forwarding of incoming ssh connections, redirecting
to VMs running in a different namespace. Crossing VRFs with netfilter
most likely will not work without some development. You might be able to
do it with XDP - rewrite packet headers and redirect. That too might
need a bit of development depending on the netdevs involved.