Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to implement the following scenario: One VM-host, multiple guest VMs, each one gets its own IP-address (and domain).

Our server has only one physical interface, so the intended use is to add virtual interfaces on eth0. To complicate our situation the provider uses port-security on their switches, so I can't run the guest interfaces in bridged mode, because then the switch detects a "spoofed" MAC-address and kills the interface (permanently, forcing me to call the support, which I'm sure will get them a little bit angry the third time ;) ).

My first guess was to use iptables and NAT to forward all packages from one virtual interface to another one, but iptables doesn't seem to like virtual interfaces (at least I can't get it to work properly). So my second guess is to use the source IP of the packages to the public interface.

Let's assume libvirt creates a virbr0-network with 192.168.100.0/24 and the guest uses 192.168.100.2 as IP-address.

This is what I tried to use: iptables -t nat -I PREROUTING --src public_ip_on_eth0:0 -p tcp --dport 80 -j DNAT --to-destination 192.168.100.2:80

That doesn't give me the intended results either (accessing the server times out).

Is there a way to do what I'm trying to do, or even to route all traffic to a certain IP on a virtual interface to the VM's device?

share|improve this question
1  
If you're getting a timeout, it could be that the request is making it to the VM, but the response isn't making it back out. You can check your server log (port 80 means a web server, right?) to see if the request's hitting the server. –  jetboy May 29 '12 at 18:08
add comment

3 Answers

to use DNAT like this you need your guest systems to have VM-host as default gateway.

share|improve this answer
    
So you mean I need to setup the guest to use eth0:0's IP (or whatever virtual device I'm going to use) as default gateway and not 192.168.100.1, which is the virbrX device? –  Alex May 29 '12 at 13:19
add comment

I had a similar network configuration and I used this configuration :

localnetwork (192.168.0.0/24) <-> host eth0 (192.168.0.10)

host tun0 (192.168.1.150) <-> vm1 eth0 (192.168.1.200) gw 192.168.1.150
                          <-> vm2 eth0 (192.168.1.201) gw 192.168.1.150

All my VMs can ping each other and can access the outside network with this iptable rule :

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
SNAT       all  --  192.168.1.0/24       0.0.0.0/0            to:192.168.0.10

The outside network can access services on my VMs with these rules :

Chain PREROUTING (policy ACCEPT)
target  prot opt source     destination         
DNAT    tcp  --  0.0.0.0/0  192.168.0.10  tcp dpt:22200 to:192.168.1.200:22
DNAT    tcp  --  0.0.0.0/0  192.168.0.10  tcp dpt:22201 to:192.168.1.201:22
DNAT    tcp  --  0.0.0.0/0  192.168.0.10  tcp dpt:3389  to:192.168.1.202:3389
DNAT    tcp  --  0.0.0.0/0  192.168.0.10  tcp dpt:443   to:192.168.1.206:443
DNAT    tcp  --  0.0.0.0/0  192.168.0.10  tcp dpt:80    to:192.168.1.206:80

I configured the tun0 interface with these lines on debian in the file /etc/network/interfaces :

auto tun0
iface tun0 inet static
  address 192.168.1.150
  netmask 255.255.255.0
  pre-up tunctl -g uml-net -t tun0
  post-down tunctl -d tun0
share|improve this answer
add comment
up vote 0 down vote accepted

With the answers of Christophe Drevet and DukeLion I was able to get the desired configuration working.

I'm going to answer myself explaining my solution. Please feel free to comment on this as I haven't done network stuff in a few years and might very well have missed something very important here.

The configuration below works perfectly and allows for adding more VMs, each using a different public IP address (IPs from 172.16.0.0 used here are "public").


Network Interfaces

VM-Host, eth0        -> 172.16.0.1
VM-Host, eth0:0      -> 172.16.0.2
VM-Host, br0         -> 192.168.10.1
Virt. machine, eth0  -> 192.168.10.2 (added to br0)
                        gateway: 172.16.0.2

iptables

Connection tracking:

iptables -I FORWARD -m conntrack -d 192.168.10.0/24 --ctstate NEW,RELATED,ESTABLISHED -j ACCEPT

DNAT for the webserver on our VM:

iptables -t nat -A PREROUTING -p tcp -d 172.16.0.2 --dport 80 -j DNAT --to-destination 192.168.10.2:80

SNAT for our VM to reach the outside world:

iptables -t nat -I POSTROUTING -j SNAT --src 192.168.10.2 --to-source 172.16.0.2

Block all other ports on the VM:

iptables -A INPUT -d 172.16.0.2 -j REJECT --reject-with icmp-port-unreachable

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.