Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Try as I might, I can't get this to work now for 2 days. Your move, internet.

I want iptables to transparently forward (localhost) 192.168.1.40:2222 to 192.168.2.22:22 and I don't want 192.168.2.0/24 to have access to any of 192.168.1.0/24

I have a wideband business class cable connection feeding into my office, which can take traffic on just about any port. It is quite limited in its feature sets so for years I've double NAT'ed to a nicer netgear wifi router (bridging it to the upstream modem isn't possible). From the first cable modem I forward all ports to the netgear router and from there I forward to everything else (media server, mail server, vpn server, etc)

Today I put a VM on a new vmware NAT network though. I want it completely isolated from the main network, and I want to transparently forward from its host on the main network to its vmware NAT'ed network. Topology:

        192.168.0.0/24    
+-----+   +-------+   +--------------+   +----------------------+
| WAN |<->| Modem |<->| Netgear wifi |<->| Debian Linux 7       |
+-----+   +-------+   | Router       |   | Server Running       |
                      +--------------+   | VMWARE Workstation   |
                       192.168.1.0/24    +----------------------+
                                           eth0:    192.168.1.40
                                           vmnet99: 192.168.2.1
                                                \\_+--------------+
                                                 \_| Guest        |
                                                   | Linux VM     |
                                                   | 192.168.2.22 |
                                                   +--------------+
    -Public IP-
 173.175.202.93:2222
         |
      -Modem-
  192.168.0.1:2222
         |
      -Router-
  192.168.1.1:2222           <=========== Flow of traffic
         |
-Host Server/iptables-
  192.168.1.40:2222
         |
  -Virtual Machine-
   192.168.2.22:22

When I type nc localhost 2222 on the main host, I want the guest to respond with an ssh prompt. That what I need, so that it behaves like this:

+-----+   +-------------------+   +--------------------+
| WAN |<->| PUB IP, Port 2222 |<->| VM 192.168.2.22:22 |
+-----+   +-------------------+   +--------------------+

I've tried to accomplish this using the firewall rules below on the VMware host, and many, many other similar forms of iptables rules. No matter what I try, it does NOT work:

:PREROUTING ACCEPT [30:4605]
:INPUT ACCEPT [18:3693]
:OUTPUT ACCEPT [330:21304]
:POSTROUTING ACCEPT [342:22216]
-A PREROUTING -p tcp -m tcp --dport 2222 -j DNAT --to-destination 192.168.2.22:22
-A POSTROUTING -p tcp -m tcp -j MASQUERADE
COMMIT
# Completed on Tue Dec 17 12:33:29 2013
# Generated by iptables-save v1.4.14 on Tue Dec 17 12:33:29 2013
*filter
:INPUT ACCEPT [3188:201562]
:FORWARD ACCEPT [6:582]
:OUTPUT ACCEPT [4390:6225036]
-A FORWARD -d 192.168.2.22/32 -o vmnet99 -p tcp -m tcp --dport 22 -j ACCEPT
COMMIT
# Completed on Tue Dec 17 12:33:29 2013

What do I need to do to get 192.168.1.40 to forward transparently back and forth for 192.168.2.22 ??

UPDATE: You can download the wireshark capture file here: http://www.atrixnet.com/wireshark_capture_2013-12-17-14-04-09.pcapng.gz (While the capture was running I ran this command: $ ping -c1 192.168.2.22 ; sleep 1 ; nc localhost 2222)

share|improve this question

closed as off-topic by Wesley, mdpc, MadHatter, cole, Ward Dec 18 '13 at 4:43

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must be relevant to professional system administration. Server Fault is dedicated to professional system and network administrators. End user and enthusiast questions are off-topic (contact your system administrator or hire a professional to help you out). Please see the Help Center for more information." – Wesley, mdpc, cole, Ward
If this question can be reworded to fit the rules in the help center, please edit the question.

1  
When I type nc localhost 2222 - When you type that with your current rules what happens? Do you get an error, or what? Can you fire up tcpdump on the VM host, or the VM guest and see if the packets are being modified? –  Zoredache Dec 17 '13 at 19:33
1  
Not sure to understand : you want to be redirected to 192.168.2.22:22 when you type publicip:2222 ? –  krisFR Dec 17 '13 at 20:01
1  
@linuxrawkstar : still not understand. According to your scheme port 2222 is for public ip, so what localhost:2222 means for you in this case ? –  krisFR Dec 17 '13 at 20:12
1  
Why do you want things to be so complicated by using so many hops ? i would use port-forwarding at Router side : publicip:2222 --> 192.168.2.22:22 and use iptables to isolate (filter) your internals LANs –  krisFR Dec 17 '13 at 20:23
1  
You do know that port-forwarding on a host can't be tested from that host, don't you? –  MadHatter Dec 17 '13 at 20:47

1 Answer 1

As @MadHatter pointed out in the comments, the iptables forwarding and NAT'ting can't be tested from the inside. You have to follow the path that the packets would follow from an external point of origin.

In other words, your testing will fail if you attempt to activate the port redirection right from the server whose IP tables implement the forwarding. You can't do it on the localhost! SSH to a server outside your network and try to re-enter the network on the port that you're forwarding.

If your iptables rules are correct like the ones you see here, you will find that the port forwarding works perfectly.

TIP: If you are running on a Debian-based Linux distro, install the iptables-persistent package to keep your iptables tweaks persistent between reboots.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.