I have a very odd situation with my ssh connection. Every time I connect to my server, whatever is my external ip, the connection have as source the server's external ip.Example    Server S.O.:  PCLinuxOS    Client ip:    [C.C.C.C]    Server ip:    [S.S.S.S]After ssh successful connection, I execute the last command and I get this:  username pts/0        [S.S.S.S]   Wed Jan 29 19:29   still logged inThis is the result of netstat searching for port 22:$ netstat -atn | egrep '(:22)'tcp        0     96 192.168.1.34:22            [S.S.S.S]:31685        ESTABLISHEDI can't find the client ip [C.C.C.C] anywhere.I wouldn't have any particular issue on this, but now comes the best part.I found an attack on my server inside the auth.log:Jan 27 12:55:42 localhost sshd[2295]: Invalid user a from [S.S.S.S]Jan 27 12:55:42 localhost sshd[2295]: input_userauth_request: invalid user a [preauth]Jan 27 12:55:42 localhost sshd[2299]: Invalid user a from [S.S.S.S]Jan 27 12:55:42 localhost sshd[2299]: input_userauth_request: invalid user a [preauth]Jan 27 13:49:58 localhost sshd[17917]: Invalid user jack from [S.S.S.S]Jan 27 13:49:58 localhost sshd[17917]: input_userauth_request: invalid user jack [preauth]Jan 27 13:50:07 localhost sshd[17923]: Invalid user ibsadmin from [S.S.S.S]Jan 27 13:50:07 localhost sshd[17923]: input_userauth_request: invalid user ibsadmin [preauth]After this attack the result is that my fail2ban daemon will insert the server IP [S.S.S.S] on the banned list and I can't connect to my server anymore.The server is behind a router with a NAT port forwarding on ssh port. The issue is not present when I connect to the server from inside my LAN, the correct IP is showed in this case.This is my sshd_config file:AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGESAcceptEnv LC_IDENTIFICATION LC_ALLAcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENTAuthorizedKeysFile      .ssh/authorized_keysChallengeResponseAuthentication noClientAliveInterval 60HostKey /etc/ssh/ssh_host_dsa_keyHostKey /etc/ssh/ssh_host_keyHostKey /etc/ssh/ssh_host_rsa_keyIgnoreRhosts yesKeyRegenerationInterval 1hLoginGraceTime 30MaxAuthTries 2MaxSessions 4MaxStartups 10:30:60PasswordAuthentication noPermitEmptyPasswords noPermitRootLogin noPort 22PubkeyAuthentication yesRSAAuthentication yesStrictModes yesSubsystem       sftp    /usr/lib64/ssh/sftp-serverTCPKeepAlive yesUseDNS  noUsePAM noUsePrivilegeSeparation yesX11Forwarding yesI know for sure that I didn't had this issue one month ago, but I can't figure out what is changed.EDIT:This is the result of iptables -L command:$ iptables -LChain INPUT (policy ACCEPT)target     prot opt source               destinationfail2ban-SSH  tcp  --  anywhere             anywhere             tcp dpt:sshChain FORWARD (policy ACCEPT)target     prot opt source               destinationChain OUTPUT (policy ACCEPT)target     prot opt source               destinationChain fail2ban-SSH (1 references)target     prot opt source               destinationRETURN     all  --  anywhere             anywhere
On ssh connection the auth.log shows as source IP the external IP of the server instead of the IP of the client
linux;networking;ssh;routing;ip