Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a server running Xen with the following network configuration

root@ubuntu:~# cat /etc/network/interfaces
# The loopback network interface
auto lo
iface lo inet loopback

auto xenbr0
iface xenbr0 inet static
    bridge_ports none
    address 192.168.2.1
    netmask 255.255.255.0
    network 192.168.2.0
    broadcast 192.168.2.255


# The primary network interface
auto eth0
iface eth0 inet static
        address 192.168.1.20
        netmask 255.255.255.0
        network 192.168.1.0
        broadcast 192.168.1.255
        gateway 192.168.1.1

I also have

(network-script network-nat)
(vif-script     vif-nat)

enabled in /etc/xen/xend-config.sxp and masquerade set up with iptables:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

From this server I can connect to domU at 192.168.2.2. SSH works, too. After sshing in, I can ping outside hosts like 8.8.8.8 and my own machine at 192.168.1.150.

I'd like to redirect traffic going destined for ssh on 192.168.2.2:22 to another address and port, 192.168.1.20:2022.

This rules don't works:

 iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 2022 -j DNAT --to-destination 192.168.2.2:22

and this:

iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 2022 -j DNAT --to-destination 192.168.2.2:22
iptables -t nat -A POSTROUTING -s 192.168.2.0/255.255.255.0 ! -d 192.168.2.0/255.255.255.0 -p tcp -j MASQUERADE --to-ports 1024-65535
iptables -t nat -A POSTROUTING -s 192.168.2.0/255.255.255.0 ! -d 192.168.2.0/255.255.255.0 -p udp -j MASQUERADE --to-ports 1024-65535
iptables -t nat -A POSTROUTING -s 192.168.2.0/255.255.255.0 ! -d 192.168.2.0/255.255.255.0 -j MASQUERADE 

What should I do? Can I do it with iptables? If so, how?

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.