Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a server with a IP 1.0.0.5/24. This is the main IP address of the server, and now I have two other IP addresses for the server, they are 1.0.2.30/24 and 1.0.2.31/24. I want to make a VirtualBox running another OS accessible through the Internet, and only allow the specified IP to reach the virtual box.

I'm new to iptables and therefore I need some basic help and getting started information about this.

The hosting provider does not allow more than on MAC address per switch port, which means that I'm not able to make bridge as far as I know.

Futhermore I want the host, to reject the extra IPs so its only the VirtualBox / virtual machine that accepts the request's on the extra IPS.

share|improve this question
    
I hope you're not actually using 1.0.0.0/8 as internal addresses. –  Shane Madden May 31 '12 at 2:13

1 Answer 1

up vote 2 down vote accepted

I haven't tested this, but this is what I would try.

  1. Create a new bridge on the host with brctl

    brctl addbr br0
    
  2. Configure the VM with bridged networking connected to this bridge

  3. Assign a private subnet to the bridge and give the host an IP on it

    ip addr add 192.168.1.1/24 dev br0
    ip route add 192.168.1.0/24 dev br0
    
  4. Either statically configure the VM with an IP on this range (e.g. 192.168.1.2), or setup a DHCP server on the host (e.g. dnsmasq or VirtualBox's dhcpserver).

  5. Check that the host can access the VM and vice versa on the private IPs
  6. Attach the static IP to eth0 on the host

    ip addr add 1.0.2.30/24 dev eth0
    
  7. Check that you can connect to the host on the additional IP from outside

  8. Enable IP forwarding on the host

    echo 1 > /proc/sys/net/ipv4/ip_forward
    
  9. Configure iptables to SNAT outgoing packets from the VM

    iptables --table nat --append POSTROUTING --source 192.168.1.0/24 --jump SNAT --to 1.0.2.30
    iptables --append FORWARD --source 192.168.1.0/24 --jump ACCEPT
    
  10. Check that the VM has connectivity to the Internet

  11. Configure iptables to DNAT packets to the additional IP to the VM

    iptables --table nat --append PREROUTING --destination 1.0.2.30 --to-destination 192.168.1.2
    iptables --append FORWARD --destination 192.168.1.2 --jump ACCEPT
    
  12. Check that you can connect to the VM on the additional IP from outside

share|improve this answer
    
I will give it a try later when i got the time for it. :) –  Klaes S. Jun 8 '12 at 15:36
    
It worked like a charm though i had to add, some information in the iptables line. –  Klaes S. Jun 13 '12 at 11:10
    
But the VM is actually not able to make any connection from the inside to the outside, but able to make connection to the host machine, Any solution to this problem ? –  Klaes S. Jun 13 '12 at 11:17
    
@KlaesS. You also need SNAT on outgoing packets, I've updated my answer. –  mgorven Jun 13 '12 at 16:57
    
Yes i can see that but now it seems not to work.. but i will try to dig into it and see if i have made a TYPO somewhere. –  Klaes S. Jun 14 '12 at 14:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.