Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have enabled network forwarding on ip say 10.20.20.34 on eth0. I am running KVM on say 10.20.20.45 and a vm is running on it with its display on port 5902. I can access the display if i connect directly to 10.20.20.45:5902 using vinagre or vncviewer. But i want to access it through 10.20.20.34, that any connection coming on 10.20.20.34 ranging in ports between 5900:6000 to be forwarded to 10.20.20.45 ranging 5900:6000.

I am new to networking and have tried to do this using iptables but could not help myself.

Any advise would be very helpful Thanks in advance

share|improve this question

1 Answer 1

To map an individual destination port NAT you would use the following command:

iptables -t nat -A PREROUTING  -p tcp -m tcp   -d 10.20.20.34  --dport 5900 -j DNAT --to-destination 10.20.20.45:5900

You should be able to NAT the whole range of ports by using the following command:

iptables -t nat -A PREROUTING -p tcp -m tcp -d 10.20.20.34 --dport 5900:6000 -j DNAT --to-destination 10.20.20.45:5900-6000

Depending on your other rules you may also need an outbound filter rule allowing the post-NAT traffic to 10.20.20.45:

iptables -A OUTPUT -p tcp -m tcp -d 10.20.20.45 --dport 5900:500 -j ACCEPT

There are a couple of things that make your environment a bit unusual. Since the real server (10.20.20.45) and the NAT server (10.20.20.34) are on the same network you will need to traffic from the real server to 10.20.20.34 so that the NAT mapping is maintained for return traffic.

You should make sure that ICMP redirects are disabled on the NAT server (10.20.20.34) as well. This is set in the /etc/sysctl.conf file. To disable ICMP redirects on all interfaces make sure the following value is set to 1.

net.ipv4.conf.all.send_redirects = 1

Let me know if that works for you.

share|improve this answer
    
Mike thanks for the response. I tried the above but still i am unable to connect from outside or even same network. Is there anything that we can do to trace the connection, like where is the fault. –  Jatin Kumar Jan 26 '11 at 8:54
    
Have you looked at the /var/log/messages on 10.20.20.34 to see if there is any indication if the traffic is being dropped? I would try running tcpdump on this system to look at the traffic coming in and out of the server. You can also run tcpdump on the 10.20.20.45 server to see what traffic if any is arriving. –  Mike H. Jan 27 '11 at 4:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.