Forwarding ports of KVM guests

Question

I have enabled network forwarding on ip say 10.20.20.34 on eth0. I am running KVM on say 10.20.20.45 and a vm is running on it with its display on port 5902. I can access the display if i connect directly to 10.20.20.45:5902 using vinagre or vncviewer. But i want to access it through 10.20.20.34, that any connection coming on 10.20.20.34 ranging in ports between 5900:6000 to be forwarded to 10.20.20.45 ranging 5900:6000.

I am new to networking and have tried to do this using iptables but could not help myself.

Any advise would be very helpful Thanks in advance

Answer 1

To map an individual destination port NAT you would use the following command:

iptables -t nat -A PREROUTING  -p tcp -m tcp   -d 10.20.20.34  --dport 5900 -j DNAT --to-destination 10.20.20.45:5900

You should be able to NAT the whole range of ports by using the following command:

iptables -t nat -A PREROUTING -p tcp -m tcp -d 10.20.20.34 --dport 5900:6000 -j DNAT --to-destination 10.20.20.45:5900-6000

Depending on your other rules you may also need an outbound filter rule allowing the post-NAT traffic to 10.20.20.45:

iptables -A OUTPUT -p tcp -m tcp -d 10.20.20.45 --dport 5900:500 -j ACCEPT

There are a couple of things that make your environment a bit unusual. Since the real server (10.20.20.45) and the NAT server (10.20.20.34) are on the same network you will need to traffic from the real server to 10.20.20.34 so that the NAT mapping is maintained for return traffic.

You should make sure that ICMP redirects are disabled on the NAT server (10.20.20.34) as well. This is set in the /etc/sysctl.conf file. To disable ICMP redirects on all interfaces make sure the following value is set to 1.

net.ipv4.conf.all.send_redirects = 1

Let me know if that works for you.