Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a machine with Virtual Machine with local IP NAT ed to Public IPs.

When a request comes to public IP on port 80 it will be redirected to VM with local IP.

This is the iptable rule we are using:

iptables -t nat -A PREROUTING -p tcp -d public-ip --dport 80 -j DNAT --to ip-of-vm:80

There are cases that request has to be send from vm to itself, through public IP.

But it's not happening ie VM can not communicate to itself through public IP. I tried to telnet to public IP port 80 from the vm ,but connection is not happening even with network connectivity.

Is there a way I can solve this issue?

netstat on vm shows

$ netstat -ntp |grep 80
tcp        0      1 localip:53067    public-ip:80        SYN_SENT    22226/telnet**

output of iptables-save -c:

consider 192.168.61.31 as pub ip on eth0 192.168.61.40 as pub ip on eth0:1

# Generated by iptables-save v1.4.12 on Wed Jun 13 13:29:06 2012
*nat
:PREROUTING ACCEPT [9:1584]
:INPUT ACCEPT [9:1584]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [12:720]
[222:13320] -A PREROUTING -d 192.168.61.40/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.122.43:80
[164:9840] -A PREROUTING -d 192.168.61.31/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.122.42:80
[15:16631] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
[76:5092] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
[0:0] -A POSTROUTING -s 192.168.122.0/32 -o virbr0 -p tcp -m tcp --dport 80 -j SNAT --to-source 192.168.61.31
COMMIT
# Completed on Wed Jun 13 13:29:06 2012

# Generated by iptables-save v1.4.12 on Wed Jun 13 13:29:06 2012
*mangle
:PREROUTING ACCEPT [491283:64985216]
:INPUT ACCEPT [467366:60033592]
:FORWARD ACCEPT [23752:4941940]
:OUTPUT ACCEPT [472767:103297872]
:POSTROUTING ACCEPT [496519:108239812]
[0:0] -A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
COMMIT
# Completed on Wed Jun 13 13:29:06 2012

# Generated by iptables-save v1.4.12 on Wed Jun 13 13:29:06 2012
*filter
:INPUT ACCEPT [467244:60021819]
:FORWARD ACCEPT [23744:4941444]
:OUTPUT ACCEPT [472681:103288146]
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
COMMIT
# Completed on Wed Jun 13 13:29:06 2012
share|improve this question
    
Why does it need to connect to itself using a public IP address? –  Shane Madden Jun 13 '12 at 5:52
    
Our project Architecture is like that.It checks whether data exist in that machine through Public ip. Can you tell me why this is happening...when vm communicates to public ip it will be send back to vm through NAT,but why it is not giving any response. netstat reveals public-ip:80 SYN_SENT on the vm –  ananthan Jun 13 '12 at 6:08
add comment

1 Answer

up vote 2 down vote accepted

I think you're missing another rule:

iptables -A POSTROUTING -s $PRIVATE_NET -o $PRIVATE_INTERFACE -p tcp -m tcp --dport 80 -j SNAT --to-source $PUBLIC_IP

share|improve this answer
    
That didnt help... i am having a similar problem explained here serverfault.com/questions/74182/… but it looks complex for me,can u help in solving this issue. –  ananthan Jun 13 '12 at 7:21
    
1) please post the output of iptables-save -c. 2) note on the rules easyfwgen.morizot.net would generate given your requirements. It's not quite good for production use, but seeing which rules go where is handy. –  NekojiruSou Jun 13 '12 at 7:24
    
done..can u please go through it.. –  ananthan Jun 13 '12 at 7:32
    
you didn't add the entry I suggested, did you? –  NekojiruSou Jun 13 '12 at 7:38
1  
You need to add that at the NAT/router box. –  NekojiruSou Jun 13 '12 at 7:49
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.