0

I have a server with a IP 1.0.0.5/24. This is the main IP address of the server, and now I have two other IP addresses for the server, they are 1.0.2.30/24 and 1.0.2.31/24. I want to make a VirtualBox running another OS accessible through the Internet, and only allow the specified IP to reach the virtual box.

I'm new to iptables and therefore I need some basic help and getting started information about this.

The hosting provider does not allow more than on MAC address per switch port, which means that I'm not able to make bridge as far as I know.

Futhermore I want the host, to reject the extra IPs so its only the VirtualBox / virtual machine that accepts the request's on the extra IPS.

Improve this question
1
  • I hope you're not actually using 1.0.0.0/8 as internal addresses.
    – Shane Madden
    May 31, 2012 at 2:13

1 Answer 1

Reset to default
2

I haven't tested this, but this is what I would try.

  1. Create a new bridge on the host with brctl

    brctl addbr br0

  2. Configure the VM with bridged networking connected to this bridge

  3. Assign a private subnet to the bridge and give the host an IP on it

    ip addr add 192.168.1.1/24 dev br0
ip route add 192.168.1.0/24 dev br0

  4. Either statically configure the VM with an IP on this range (e.g. 192.168.1.2), or setup a DHCP server on the host (e.g. dnsmasq or VirtualBox's dhcpserver).

  5. Check that the host can access the VM and vice versa on the private IPs

  6. Attach the static IP to eth0 on the host

    ip addr add 1.0.2.30/24 dev eth0

  7. Check that you can connect to the host on the additional IP from outside

  8. Enable IP forwarding on the host

    echo 1 > /proc/sys/net/ipv4/ip_forward

  9. Configure iptables to SNAT outgoing packets from the VM

    iptables --table nat --append POSTROUTING --source 192.168.1.0/24 --jump SNAT --to 1.0.2.30
iptables --append FORWARD --source 192.168.1.0/24 --jump ACCEPT

  10. Check that the VM has connectivity to the Internet

  11. Configure iptables to DNAT packets to the additional IP to the VM

    iptables --table nat --append PREROUTING --destination 1.0.2.30 --to-destination 192.168.1.2
iptables --append FORWARD --destination 192.168.1.2 --jump ACCEPT

  12. Check that you can connect to the VM on the additional IP from outside

Improve this answer
6
  • I will give it a try later when i got the time for it. :)
    – Klaes S.
    Jun 8, 2012 at 15:36
  • It worked like a charm though i had to add, some information in the iptables line.
    – Klaes S.
    Jun 13, 2012 at 11:10
  • But the VM is actually not able to make any connection from the inside to the outside, but able to make connection to the host machine, Any solution to this problem ?
    – Klaes S.
    Jun 13, 2012 at 11:17
  • @KlaesS. You also need SNAT on outgoing packets, I've updated my answer.
    – mgorven
    Jun 13, 2012 at 16:57
  • Yes i can see that but now it seems not to work.. but i will try to dig into it and see if i have made a TYPO somewhere.
    – Klaes S.
    Jun 14, 2012 at 14:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .