I have a xen machine (
DomU) hosting a few VMs.
One of the VMs is called
router (10.0.0.1) and is the only one of the machines supposed to be reachable from the outside.
There are other VMs which are going to recieve traffic, but it has to be filtered.
Let's call one of these machines
web (10.0.0.2), as it serves a webpage.
Packets coming to
web follow this routing path:
xen DomU ->
-A PREROUTING -d <external_ip> -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.0.0.1:80 -A POSTROUTING -o xenbr0 -j MASQUERADE
-A PREROUTING -d 10.0.0.1 -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.0.0.2:80 -A POSTROUTING -o eth0 -j MASQUERADE
Everything works as expected.
Port 80 from the external IP is routed via
router all the way to
There is a problem tho:
10.0.0.1 as the source for the connection, rather than the real client IP.
I guess this is caused by the fact that there are two DNATing iptables.