Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have 2 ip addresses on iface eth0:

eth0      Link encap:Ethernet  HWaddr 00:19:99:a4:14:08  
          inet addr:85.25.152.115  Bcast:85.25.152.255  Mask:255.255.255.0
          inet6 addr: fe80::219:99ff:fea4:1408/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:233866 errors:0 dropped:0 overruns:0 frame:0
          TX packets:145186 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:175800889 (167.6 MiB)  TX bytes:38033903 (36.2 MiB)
          Interrupt:18 

eth0:1    Link encap:Ethernet  HWaddr 00:19:99:a4:14:08  
          inet addr:85.25.248.216  Bcast:85.25.248.255  Mask:255.255.255.192
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:18 

and I have an internal virtual iface for virtualbox guest:

tap0      Link encap:Ethernet  HWaddr ae:ba:ce:d7:7d:bd  
          inet addr:10.0.1.1  Bcast:10.255.255.255  Mask:255.0.0.0
          inet6 addr: fe80::acba:ceff:fed7:7dbd/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:111 overruns:0 carrier:0
          collisions:0 txqueuelen:500 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

10.0.1.1 is GW for the VM (10.0.1.2). The forwarding from 10.0.1.2 to the internet works perfectly, but when I'm trying to redirect all the ports from 85.25.248.216 (eth0:1) to the 10.0.1.2 it fails:

iptables -t nat -A PREROUTING -d 85.25.248.216 -j DNAT --to-destination 10.0.1.2
nmap -A -v 85.25.248.216
<...>
PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 5.8p1 Debian 4 (protocol 2.0)
| ssh-hostkey: 1024 4e:3e:ce:86:24:f8:54:7a:68:67:be:57:92:62:00:f0 (DSA)
|_2048 36:f5:0d:4c:1b:58:b8:f9:ff:0f:47:ba:88:43:69:bd (RSA)
10000/tcp open  http    MiniServ 1.540 (Webmin httpd)
|_html-title: Site doesn't have a title (text/html).
Device type: general purpose
Running: Linux 2.6.X
OS details: Linux 2.6.19 - 2.6.31

india827:~# iptables --list -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
DNAT       all  --  anywhere             static-ip-85-25-248-216.inaddr.intergenia.de to:10.0.1.2 
DNAT       tcp  --  anywhere             static-ip-85-25-248-216.inaddr.intergenia.de tcp dpt:3389 to:10.0.1.2 

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
DNAT       all  --  anywhere             static-ip-85-25-248-216.inaddr.intergenia.de to:10.0.1.2 

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  anywhere             anywhere            
SNAT       all  --  anywhere             anywhere            to:85.25.248.216 

The VM is on Windows, and there must be, at least, 3389 (RDP) opened, but I (of course!) cant connect to it too. Where is the mistake?

New rules:

iptables -t nat -A PREROUTING -d 85.25.248.216 -j DNAT --to-destination 10.0.1.2
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate NEW -d 10.0.1.2 -j ACCEPT

Result is the same...

share|improve this question

2 Answers 2

up vote 1 down vote accepted

The iptables command is correct so it must be something in the context. I'll try guessing.

IP forwarding is not enabled.

cat /proc/sys/net/ipv4/ip_forward

should give a value of 1. If not then set it to 1 by

echo 1 > /proc/sys/net/ipv4/ip_forward

You are SNATing 10.0.1.2 to 85.25.152.115 on its way out

iptables --list -t nat

should reveal that.

share|improve this answer
    
Ip forwarding is enabled. –  user59178 Apr 6 '11 at 19:50
    
iptables --list -t nat is in the first post –  user59178 Apr 6 '11 at 19:54
    
First I'd remove that SNAT to the same outside IP. This basically tells netfilter to do a PAT on all outgoing traffic, so all ports get re-assigned on their way out. I'm not sure it will take precedence over the DNAT returning traffic but it might. If you don't want to completely disable the rule you can add an exception for the specific IP like this **iptables -t nat -A POSTROUTING -s 10.0.1.2 -j ACCEPT –  AlexTsr Apr 6 '11 at 20:13
    
So, what is the correct solution for my problem? –  user59178 Apr 7 '11 at 13:18
    
Have you tried removing the SNAT rule? –  AlexTsr Apr 7 '11 at 16:56

Why not just use the Virtualbox NAT forwarding?

http://www.virtualbox.org/manual/ch06.html#natforward

Then just adjust iptables to open the host ports. You're already running a NAT router in Virtualbox, why run two?

share|improve this answer
    
Forwarding host ports < 1024 impossible: On Unix-based hosts (e.g. Linux, Solaris, Mac OS X) it is not possible to bind to ports below 1024 from applications that are not run by root. –  utapyngo Oct 15 '13 at 5:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.