Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to open and forward SSH port to one of our internal computers.

Problem is - it will use the same IP address as PCI-DSS environment (where the HTTPS payment gatway is running)

Basically firewall will forward port 22 to ssh server, port 443 to PCI-DSS environment

Is it compliant with PCI-DSS?

share|improve this question
up vote 2 down vote accepted

If the firewall is outside of what constitutes your "PCI-DSS environment" then this is mere routing. To say things bluntly, all machines share the same Internet. PCI-DSS will rely on some sort of boundary which delimits what is inside (and in scope of PCI-DSS), and the rest of the World. The latter includes the firewall, the SSH server...

In particular, the SSL layer makes a tunnel which ensures protection for data in transit between the SSL (HTTPS) client and the server, and that protection holds against all other machines in-between, including the firewall.

It all boils down to this: if your PCI-DSS compliance does not depend on the properties of the firewall (i.e. you would still comply with PCI-DSS if the firewall was removed, and your servers placed directly in contact with the Internet), then the firewall can do whatever it pleases, including forwarding SSH connections to some other server, without impacting PCI-DSS compliance.

share|improve this answer
in my case no firewall = no internet at all. firewall separates two networks (pci-dss env. and office network). – user21886 Sep 5 '13 at 14:41
I hate to disagree but there are a lot of 'firewalls' that actually have level 7 inspection capability, especially for HTTPS. If that's the case and and the decrypted cardholder data is in memory the firewall is in scope. That is an easy point for folks to get confused on and it took a couple reads to get that from your post. – Tim Brigham Sep 5 '13 at 14:59

I'm not 100% certain, but I believe that as long as you isolate the SSH system from the payment gateway you are fine. The fact they are using the same IP outside doesn't matter since port forwarding is simply directing the traffic to two separate networks. I believe the network separation is the important part and port routing doesn't directly impact that.

share|improve this answer

Just make sure your SSH Server is complient:

  • no root access to SSH
  • dont use the default port of ssh (22)
  • public key auth only
  • no shared accounts.

And you can use source-network/IP restrictions (SSH only reachable from 172.16.x.y).

But 100% safe to go, speak with your auditor.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.