How to forward a port from the Internet to another Internet server (ala gateway) on CentOs 7?

Question

System administration

Good evening friends!

In continuation of the question of hiding the RDP server, I am trying to implement what the knowledgeable people advised me, but I did not have enough knowledge, since I am completely unfamiliar with linux systems. :(

Briefly about the task so that you understand what needs to be done and why, but the previous question was not opened:
There is an RDP server located in the Russian Federation . It is necessary that the IP connection to the RDP server on the clients be different , preferably in a nearby European country. In other words, we you need an intermediary server that would accept connections on port 3389 , redirect TCP / UDP toreal IP of the server on the same port 3389, keeping the real IP secret from users and prying subjects.

It has already been popularly explained to me that this is nonsense, spy mania and, in general, a collective farm and stupidity, but the task has been set, and I am stupid, but I am trying to fulfill the wishes of the leadership in the vein of "any whim for your money."

An attempt to solve a problem that did not work for me:

I took VDS 1x2.2GHz, 1GB RAM, 1 IP. Installed CentOS 7.6.1810. I tried to pick both of the proposed options: haproxy and disabling firewalld with the inclusion of iptables. Configs are like hieroglyphs for me.

If someone has the time and desire to teach science to a fool, please describe the process of implementing this ( according to the experts of the previous question ) trifling matter for 10 minutes of work ...?

Thanks in advance for any result.

Answer 1

Come here.
Hide the RDP server... but how?

Answer 2

A task as a task, quite to itself. Apparently there are reasons to hide the fact that the target server is in the Russian Federation. It happens. There are such -
"...Where they look with tenderness
At foreign stickers...
And they eat bacon ... Russian!" (C) Mikhalkov S.V. Two friends.
To the sheep.
The task is reduced to the usual natu, which changes the destination IP from local to a remote one in a packet that arrives at port 3389 - after which the bucket of course sends this packet to the world to the default gateway.
Firstly, I recommend this scheme to everyone and everyone who has fallen into a blunt and does not know how a packet passes through netfilter. Print and hang at work.
Let's set the assumptions first.
Server IP = 212.20.5.1 (many, many years ago it was the IP of our server, it is really Russian :) )
VPS IP = 170.70.1.1 (taken from the ceiling)
The default policy for filter is ACCEPT (everything that is not prohibited is allowed A very dangerous policy, it's only for demonstration purposes, you can't do that in real life, I'm just reluctant to write additional rules for passing traffic)

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

We perform NAT in the prerouting chain of the nat table (it goes before filter). The packet gets here right after mangle prerouting.

*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A PREROUTING -p tcp --dport 3389 -d 170.70.1.1 -j DNAT --to-destination 212.20.5.1

It reads "if a packet arrives via tcp protocol on port 3389 on IP 170.70.1.1, then apply the DNAT action, replacing the destination IP with 212.20.5.1. Place the rule in the prerouting chain."
Now what? And now, since we have changed the destination IP and it is no longer local, the bucket considers that the packet needs to be sent (routing decision in the diagram) - to the forward chain. First mangle forward, then filter forward (this is the main table, which is usually called a firewall, we skip everything in it).
Then mangle postrouting and nat postrouting. In nat postrouting we need to do some camouflage. In the packet, the destination IP is 212.20.5.1 - but the source IP is the IP from which the packet came to the VPS. We do not need this, both because the task is to hide it, and because when a packet hits 212.20.5.1, it will respond directly to this IP. Therefore, we do the following:

-A POSTROUTING -o eth0 -j SNAT --to-source 170.70.1.1

We read "if the packet leaves through the eth0 interface, then apply the SNAT action and replace the source IP with 170.70.1.1"
This is a standard NAT rule, it is always present if the VPS is NAT for anything.
All. The packet to 212.20.5.1 leaves IP 170.70.1.1, it replies by the source IP, the VPS sees that there was a NAT and sends the packet to where it came from.

Answer 3

Nikita, you're going the wrong way. The answer is in your first question.