1

I have a server with a LAN facing address of 192.168.5.100 (eth0) and another LAN facing address of 192.168.6.6 (eth1).

On this server I have a Virtualbox instance of fedora running an apache webserver (on port 8080) with a bridged interface to eth1 on the host server with address of 192.168.6.7

Users on the 192.168.6.x network can access the Webserver on the Vbox instance (192.168.6.7) with no problems.

My question is what kind of iptables entries or commands should be made/executed so as to allow for users on the 192.168.5.x network to access the webserver on the vbox instance. (I'm hoping their url can be something like: http://192.168.5.100:8080)

3 Answers 3

2

There are only a few options in this instance: 1) Allow direct routing of hosts on the 192.168.5.x network to the 192.168.6.x network. (i.e a route to your network through your intermediate host 192.168.5.100 and ip forwarding enabled in the kernel.

2) Port forward 8080 to the correct ip and port (check out balance-ng and run it on the eth0 interface)

3) iptables based port forwarding / nat

/sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 -d 192.167.5.100 --dport 8080 -j DNAT --to 192.168.6.7:80
/sbin/iptables -A FORWARD -p tcp -i eth0 -d 192.168.6.7 --dport 80 -j ACCEPT

enable ip forwarding echo 1 > /proc/sys/net/ipv4/ip_forward

6
  • @Matty: I've tried this, and it doesn't seem to work. Should there be a postrouting rule that handles packets coming from the webserver to the clients on the 192.168.5.x n/w ?
    – Darider
    Nov 3, 2009 at 23:39
  • like.... /sbin/iptables -t nat -A POSTROUTING -p tcp -o eth0 -s 192.168.6.7 --to-source 192.167.5.100 I'm not sure that would be necessary. But if you have no other rules, and you aren't using conntrack then it might be. You can also add state tracking. /sbin/iptables -A FORWARD -p tcp -i eth0 -d 192.168.6.7 --dport 80 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT /sbin/iptables -A FORWARD -p tcp -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
    – MattyB
    Nov 4, 2009 at 0:07
  • The problem is the packets reaching the web-server have an ip of the 192.168.5.x domain, the webserver doesn't do anything with them doesn't even provide a response. Is there some kind of masquarding rule that can be applied such that the packets get the secondary ip of the main server (eg: 192.168.6.6)?
    – Darider
    Nov 4, 2009 at 2:51
  • Does the virtual box not have a route to the 192.168.5 network through the intermediate host? It needs a route through the local host operating system since its doing the routing.
    – MattyB
    Nov 4, 2009 at 4:11
  • the vbox instance is on the 192.168.6.x n/w is doesn't know about routing to 192.168.5.x n/w i was hoping iptable rules would do all the necessary packet munging. is there something i can do to fix this issue?
    – Darider
    Nov 4, 2009 at 7:44
1

For me, the following worked:

sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sbin/iptables -t nat -A PREROUTING -p tcp -i eth0  --dport 80 -j DNAT --to 192.168.6.7:8080

using virtualbox 3.2.12 on ubuntu 10.04 host. What the other answers did not mention is the masquerading, which in my understanding is nessessary to get the answer pakets out correctly.

1

This should forward requests on port 8080 on interface eth0 to 192.168.6.7 on interface eth1 on port 8080.

iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 8080 --to-destination 192.168.6.7:8080 -j DNAT

You must log in to answer this question.