Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a server with a IP This is the main IP address of the server, and now I have two other IP addresses for the server, they are and I want to make a VirtualBox running another OS accessible through the Internet, and only allow the specified IP to reach the virtual box.

I'm new to iptables and therefore I need some basic help and getting started information about this.

The hosting provider does not allow more than on MAC address per switch port, which means that I'm not able to make bridge as far as I know.

Futhermore I want the host, to reject the extra IPs so its only the VirtualBox / virtual machine that accepts the request's on the extra IPS.

share|improve this question
I hope you're not actually using as internal addresses. – Shane Madden May 31 '12 at 2:13
up vote 2 down vote accepted

I haven't tested this, but this is what I would try.

  1. Create a new bridge on the host with brctl

    brctl addbr br0
  2. Configure the VM with bridged networking connected to this bridge

  3. Assign a private subnet to the bridge and give the host an IP on it

    ip addr add dev br0
    ip route add dev br0
  4. Either statically configure the VM with an IP on this range (e.g., or setup a DHCP server on the host (e.g. dnsmasq or VirtualBox's dhcpserver).

  5. Check that the host can access the VM and vice versa on the private IPs
  6. Attach the static IP to eth0 on the host

    ip addr add dev eth0
  7. Check that you can connect to the host on the additional IP from outside

  8. Enable IP forwarding on the host

    echo 1 > /proc/sys/net/ipv4/ip_forward
  9. Configure iptables to SNAT outgoing packets from the VM

    iptables --table nat --append POSTROUTING --source --jump SNAT --to
    iptables --append FORWARD --source --jump ACCEPT
  10. Check that the VM has connectivity to the Internet

  11. Configure iptables to DNAT packets to the additional IP to the VM

    iptables --table nat --append PREROUTING --destination --to-destination
    iptables --append FORWARD --destination --jump ACCEPT
  12. Check that you can connect to the VM on the additional IP from outside

share|improve this answer
I will give it a try later when i got the time for it. :) – Klaes S. Jun 8 '12 at 15:36
It worked like a charm though i had to add, some information in the iptables line. – Klaes S. Jun 13 '12 at 11:10
But the VM is actually not able to make any connection from the inside to the outside, but able to make connection to the host machine, Any solution to this problem ? – Klaes S. Jun 13 '12 at 11:17
@KlaesS. You also need SNAT on outgoing packets, I've updated my answer. – mgorven Jun 13 '12 at 16:57
Yes i can see that but now it seems not to work.. but i will try to dig into it and see if i have made a TYPO somewhere. – Klaes S. Jun 14 '12 at 14:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.