Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

My server has several public IPs, and is running a bunch of virtual machines with private IP adresses.

As an example, I want to map ports 80, 443 and 8080 on 232.21.23.23 (public) to 192.168.122.12 (private). I have tried a couple of different NAT mappings, but none of them seem to work:

# This doesn't work.
DNAT           net              loc:192.168.122.12  tcp  80,443,8080  -           232.21.23.23

# Neither does this.
DNAT           $FW              loc:192.168.122.12  tcp  80,443,8080  -           232.21.23.23

# Nor this.
DNAT           net:232.21.23.23 loc:192.168.122.12  tcp  80,443,8080

# I have no idea what I'm doing.
DNAT           $FW:232.21.23.23 loc:192.168.122.12  tcp  80,443,8080

Can anyone point me in the right direction?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

Your first rule is correct:

DNAT    net loc:192.168.122.12  tcp 80,443,8080 -   232.21.23.23

So the problem must lie elsewhere. You can see the underlying iptables rules created with this:

iptables -t nat -nvL net_dnat

NATed packets still need to traverse the FORWARD chain and be accepted. Try adding the following rule to accept traffic to the VMs on these ports:

ACCEPT  net loc:192.168.122.12  tcp 80,443,8080
share|improve this answer

As an additional comment to the previous answers, make sure the order in which you place rules.

Example:

Let's say you configured your rules like this:

DNAT net loc:172.17.20.25 tcp 80 0.0.0.0 DNAT net loc:172.17.20.47 tcp 80 200.x.y.z

If you wanna get to 172.17.20.47 on port 80, you will always end up in 172.17.20.25 because the destination address is the default 0.0.0.0.

So if you wanna get to 172.17.20.47 trough public ip address 200.x.y.z, you should modify the order of the rules:

DNAT net loc:172.17.20.47 tcp 80 200.x.y.z DNAT net loc:172.17.20.25 tcp 80 0.0.0.0

Or modifiy the default address of the first rule.

I hope it helps!

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.