Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to implement the following scenario: One VM-host, multiple guest VMs, each one gets its own IP-address (and domain).

Our server has only one physical interface, so the intended use is to add virtual interfaces on eth0. To complicate our situation the provider uses port-security on their switches, so I can't run the guest interfaces in bridged mode, because then the switch detects a "spoofed" MAC-address and kills the interface (permanently, forcing me to call the support, which I'm sure will get them a little bit angry the third time ;) ).

My first guess was to use iptables and NAT to forward all packages from one virtual interface to another one, but iptables doesn't seem to like virtual interfaces (at least I can't get it to work properly). So my second guess is to use the source IP of the packages to the public interface.

Let's assume libvirt creates a virbr0-network with and the guest uses as IP-address.

This is what I tried to use: iptables -t nat -I PREROUTING --src public_ip_on_eth0:0 -p tcp --dport 80 -j DNAT --to-destination

That doesn't give me the intended results either (accessing the server times out).

Is there a way to do what I'm trying to do, or even to route all traffic to a certain IP on a virtual interface to the VM's device?

share|improve this question
If you're getting a timeout, it could be that the request is making it to the VM, but the response isn't making it back out. You can check your server log (port 80 means a web server, right?) to see if the request's hitting the server. – jetboy May 29 '12 at 18:08

to use DNAT like this you need your guest systems to have VM-host as default gateway.

share|improve this answer
So you mean I need to setup the guest to use eth0:0's IP (or whatever virtual device I'm going to use) as default gateway and not, which is the virbrX device? – Alex May 29 '12 at 13:19

I had a similar network configuration and I used this configuration :

localnetwork ( <-> host eth0 (

host tun0 ( <-> vm1 eth0 ( gw
                          <-> vm2 eth0 ( gw

All my VMs can ping each other and can access the outside network with this iptable rule :

target     prot opt source               destination         
SNAT       all  --            to:

The outside network can access services on my VMs with these rules :

target  prot opt source     destination         
DNAT    tcp  --  tcp dpt:22200 to:
DNAT    tcp  --  tcp dpt:22201 to:
DNAT    tcp  --  tcp dpt:3389  to:
DNAT    tcp  --  tcp dpt:443   to:
DNAT    tcp  --  tcp dpt:80    to:

I configured the tun0 interface with these lines on debian in the file /etc/network/interfaces :

auto tun0
iface tun0 inet static
  pre-up tunctl -g uml-net -t tun0
  post-down tunctl -d tun0
share|improve this answer
up vote 1 down vote accepted

With the answers of Christophe Drevet and DukeLion I was able to get the desired configuration working.

I'm going to answer myself explaining my solution. Please feel free to comment on this as I haven't done network stuff in a few years and might very well have missed something very important here.

The configuration below works perfectly and allows for adding more VMs, each using a different public IP address (IPs from used here are "public").

Network Interfaces

VM-Host, eth0        ->
VM-Host, eth0:0      ->
VM-Host, br0         ->
Virt. machine, eth0  -> (added to br0)


Connection tracking:

iptables -I FORWARD -m conntrack -d --ctstate NEW,RELATED,ESTABLISHED -j ACCEPT

DNAT for the webserver on our VM:

iptables -t nat -A PREROUTING -p tcp -d --dport 80 -j DNAT --to-destination

SNAT for our VM to reach the outside world:

iptables -t nat -I POSTROUTING -j SNAT --src --to-source

Block all other ports on the VM:

iptables -A INPUT -d -j REJECT --reject-with icmp-port-unreachable

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.