Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have kvm guest which's netword card is conntected to the host using a tap device. The tap device is part of a bridge on the host together with eth0 so it can access the public network. So far everything works, the guest can access the public network and it can be accessed from the public network.

Now the kvm process on the host provides a vnc server for the guest which listens on on the host. Is there any way to make this vnc server accessible by the ip address which the guest is using (ex., without interrupting the guest from using the same ip (port 5901 is not used by the guest)? It should also work when the guest is not using any ip address at all. So basically I just want to fake IP xx is on the host and only answer/ forward traffic to port 5901 to the host itself.

I tried using this NAT rule on the host, but it doesn't work. Ip forwarding is enabled at the host.

iptables -t nat -A PREROUTING -p tcp --dst --dport 5901 -j DNAT --to-destination

I assume this is because the IP is not not bound to any interfaces and so no ARP requests for it get answered and so no packets for this IP arrive at the host. How can make it work? :)

share|improve this question

You're on the right track with the iptables rule, but since your host is acting as a bridge, not a router, the packets for your guest never reach the IP layer, which is where iptables operates.

Fortunately, Linux has an equivalent to iptables for the Ethernet layer called ebtables. Using ebtables, you can write this rule:

ebtables -t nat -A PREROUTING -p ipv4 --ip-protocol tcp --ip-dst --ip-destination-port 5901 -j redirect

This rule will match any IP packet destined to that address/port and "redirect" it, which means rewrite its MAC address to be the same as the bridge device it arrived on. This will cause the packet to end up in your IP layer, at which point you can use iptables to DNAT the destination IP address (as you're currently doing).

Most distros' kernels should support ebtables. You may need to install a package ("ebtables" in Debian and Ubuntu) to get the ebtables user space program.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.