0

I would like to forward some ports (specifically TCP 22, UDP 1194, TCP 80, TCP 443) from a Windows Server 2003 to a Linux VM running inside VirtualBox on the same machine. Is there an easy and reliable way to do that? Currently the VM is on a bridged network with the server and should remain accessible from outside (LAN) on all other ports.

2 Answers 2

2

That's not a real solution in my opinion. You were referring to a bridged network and how to do that on a windows hosted machine.

Your answer is not to use bridging on a windows hosted machine but use NAT.

From my point of view, that's like someone asking how to replace the batteries of a Mercedes and answering: use a VW.

So to get back to bridged networking VM on a windows host.

Windows doesn't forward the packets to the virtual adapter. So when your windows machine is using 192.168.1.2 and your virtual machine bridged on 192.168.1.3 from the point of view from your router where you forward packets to either 192.168.1.2 or 192.168.1.3 this all comes in the end at the NIC used by your windows, thus 192.168.1.2. Due to some lower layer protocols used INSIDE a LAN this doesn't apply inside the LAN! You LAN machines going to 192.168.1.3 will actually be seen by the virtual LAN adapter while router forwarded packets are not. So port forwarding on your router to either 192.168.1.2 or 192.168.1.3 will always arrive at 192.168.1.2 but inside the LAN with some lower level layered packets windows understands it's not meant for 192.168.1.2 but for 192.168.1.3 instead.

This is a limitation by windows and how windows packets are treated different from withing a LAN with some more lower layer data to the packets compared to internet packets that lack this information windows needs to know it's not for the main NIC but meant for the bridged virtual.

Blocking packets from arriving at windows or allowing (Firewall) doesn't change anything to this problem! It's just how the host OS will handle the packets first before you virtual adapter can get its hands on the packets (thus never in this case) This has to be determined long before the firewall rules are actually hit.

There is however a solution, you can still bridge your VM with your windows host, use the bridged networking possibilities and lower layer network protocols in your network AND still tell windows that packets on specific ports are meant for the VM and not with windows NIC!

For this you can use: netsh interface portproxy add v4tov4 listenport=80 connectport=80 connectaddress=192.168.1.3

Now all incoming packets on port 80 to either 192.168.1.2 or 192.168.1.3 are both still incoming at your host OS (Windows) but windows now forwards them to the VM at 192.168.1.3

That's how you setup a bridged networking with all the benefits of actually being part of the LAN the host is connected to as well AND still get the proper packets to arrive at your VM right where you want them to arrive.

Hope this explains a bit how to set it up. The specific explanation why windows handles packets from outside-router-forwarded-packets different from those inside the LAN is of course not explained by this but I think this is not relevant to your question. You asked how to get this done in a bridged environment.

So good luck. Above solution has been tested and proven to work.

2
  • Hi Vince, welcome to Unix & Linux SE! In you first paragraph, you are replying to another answer. You might want to avoid that, as answers can potentially be deleted, or displayed below your answer rather than above it. I recommend that you rephrase that part so it doesn't "reply" to another answer, or that you quote a relevant piece of that answer so the context is clear :)
    – marcelm
    Sep 24, 2017 at 19:31
  • Thanks for your long and complete answer, but 4 years have passed and we have switched to a virtualized setup all together!
    – schneida
    Sep 25, 2017 at 18:28
0

Found a solution myself:

Changed network settings to NAT in Virtualbox and use builtin feature to tunnel arbitrary ports to the VM. This has the drawback, that the VM can't log any IPs (as NAT prevents that) and other than the specified ports are not available any more, but as you can specify as much as you want, it's not a showstopper for me.

Not the answer you're looking for? Browse other questions tagged .