up vote 1 down vote favorite
share [g+] share [fb]

I have 2 ip addresses on iface eth0: 

eth0      Link encap:Ethernet  HWaddr 00:19:99:a4:14:08  
          inet addr:85.25.152.115  Bcast:85.25.152.255  Mask:255.255.255.0
          inet6 addr: fe80::219:99ff:fea4:1408/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:233866 errors:0 dropped:0 overruns:0 frame:0
          TX packets:145186 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:175800889 (167.6 MiB)  TX bytes:38033903 (36.2 MiB)
          Interrupt:18 

eth0:1    Link encap:Ethernet  HWaddr 00:19:99:a4:14:08  
          inet addr:85.25.248.216  Bcast:85.25.248.255  Mask:255.255.255.192
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:18

and I have an internal virtual iface for virtualbox guest:

tap0      Link encap:Ethernet  HWaddr ae:ba:ce:d7:7d:bd  
          inet addr:10.0.1.1  Bcast:10.255.255.255  Mask:255.0.0.0
          inet6 addr: fe80::acba:ceff:fed7:7dbd/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:111 overruns:0 carrier:0
          collisions:0 txqueuelen:500 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

10.0.1.1 is GW for the VM (10.0.1.2). The forwarding from 10.0.1.2 to the internet works perfectly, but when I'm trying to redirect all the ports from 85.25.248.216 (eth0:1) to the 10.0.1.2 it fails:

iptables -t nat -A PREROUTING -d 85.25.248.216 -j DNAT --to-destination 10.0.1.2
nmap -A -v 85.25.248.216
<...>
PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 5.8p1 Debian 4 (protocol 2.0)
| ssh-hostkey: 1024 4e:3e:ce:86:24:f8:54:7a:68:67:be:57:92:62:00:f0 (DSA)
|_2048 36:f5:0d:4c:1b:58:b8:f9:ff:0f:47:ba:88:43:69:bd (RSA)
10000/tcp open  http    MiniServ 1.540 (Webmin httpd)
|_html-title: Site doesn't have a title (text/html).
Device type: general purpose
Running: Linux 2.6.X
OS details: Linux 2.6.19 - 2.6.31

india827:~# iptables --list -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
DNAT       all  --  anywhere             static-ip-85-25-248-216.inaddr.intergenia.de to:10.0.1.2 
DNAT       tcp  --  anywhere             static-ip-85-25-248-216.inaddr.intergenia.de tcp dpt:3389 to:10.0.1.2 

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
DNAT       all  --  anywhere             static-ip-85-25-248-216.inaddr.intergenia.de to:10.0.1.2 

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  anywhere             anywhere            
SNAT       all  --  anywhere             anywhere            to:85.25.248.216

The VM is on Windows, and there must be, at least, 3389 (RDP) opened, but I (of course!) cant connect to it too. Where is the mistake?

New rules:

iptables -t nat -A PREROUTING -d 85.25.248.216 -j DNAT --to-destination 10.0.1.2
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate NEW -d 10.0.1.2 -j ACCEPT

Result is the same...

link|improve this question
69% accept rate
feedback

2 Answers

up vote 1 down vote accepted

The iptables command is correct so it must be something in the context. I'll try guessing.

IP forwarding is not enabled.

cat /proc/sys/net/ipv4/ip_forward

should give a value of 1. If not then set it to 1 by 

echo 1 > /proc/sys/net/ipv4/ip_forward

You are SNATing 10.0.1.2 to 85.25.152.115 on its way out

iptables --list -t nat

should reveal that.

link|improve this answer
Ip forwarding is enabled. – user59178 Apr 6 '11 at 19:50
iptables --list -t nat is in the first post – user59178 Apr 6 '11 at 19:54
First I'd remove that SNAT to the same outside IP. This basically tells netfilter to do a PAT on all outgoing traffic, so all ports get re-assigned on their way out. I'm not sure it will take precedence over the DNAT returning traffic but it might. If you don't want to completely disable the rule you can add an exception for the specific IP like this **iptables -t nat -A POSTROUTING -s 10.0.1.2 -j ACCEPT – AntiFubar Apr 6 '11 at 20:13
So, what is the correct solution for my problem? – user59178 Apr 7 '11 at 13:18
Have you tried removing the SNAT rule? – AntiFubar Apr 7 '11 at 16:56
show 5 more comments
feedback
up vote 0 down vote

Why not just use the Virtualbox NAT forwarding?

http://www.virtualbox.org/manual/ch06.html#natforward

Then just adjust iptables to open the host ports. You're already running a NAT router in Virtualbox, why run two?

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.