Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a KVM machine with two guests and the following route:

89.114.150.3 (eth0:0 alias)->192.168.122.1(virbr0)->192.168.122.5(vint0)

to one of these two machines (192.168.122.5 and 192.168.122.6). And I rewrote my rules in iptables:

iptables -t nat -A PREROUTING -p tcp -d 89.114.150.3 --dport 80 -j DNAT --to 192.168.122.1:80  
iptables -t nat -A PREROUTING -p tcp -d 192.168.122.1 --dport 80 -j DNAT --to 192.168.122.5:80

iptables -I FORWARD -d 192.168.122.5/32 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT

iptables -t nat -A POSTROUTING -p tcp -s 192.168.122.5 --sport 80 -j SNAT --to-source 192.168.122.1
iptables -t nat -A POSTROUTING -p tcp -s 192.168.122.1 --sport 80 -j SNAT --to-source 89.114.150.3

But I have a problem - this route is also not working... 80 - Connection refused. Why?

share|improve this question
add comment

1 Answer

Let's walk through this in iptables:

iptables -t nat -A PREROUTING -p tcp -d 89.114.150.3 --dport 80 -j DNAT --to 192.168.122.1:80  

OK, will send packets to 192.168.122.1:80. Most rules in iptables are terminating rules. LOG as a destination and some other are exceptions. Anything that matched this, we're done with the chain.

iptables -t nat -A PREROUTING -p tcp -d 192.168.122.1 --dport 80 -j DNAT --to 192.168.122.5:80

Nothing left matches unless it actually came into the computer destined for 192.168.122.1. This will not affect the packets above. I'm guess that was your goal.

Use iptables to rewrite your final destination, not to attempt mangling the packet multiple times to match the route. Your routing table will take care of sending the packet across the bridge to the right interface. Thus, your first rule should read:

iptables -t nat -A PREROUTING -p tcp -d 89.114.150.3 --dport 80 -j DNAT --to 192.168.122.5:80

Consider the same for your other rules. You have Your POSTROUTING rules need work as well. If you have other rules in your FORWARD chain that describe dropping or rejecting packets, know that you'll also need to accept ESTABLISHED,RELATED.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.