Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a server running Xen with the following network configuration

root@ubuntu:~# cat /etc/network/interfaces
# The loopback network interface
auto lo
iface lo inet loopback

auto xenbr0
iface xenbr0 inet static
    bridge_ports none
    address 192.168.2.1
    netmask 255.255.255.0
    network 192.168.2.0
    broadcast 192.168.2.255


# The primary network interface
auto eth0
iface eth0 inet static
        address 192.168.1.20
        netmask 255.255.255.0
        network 192.168.1.0
        broadcast 192.168.1.255
        gateway 192.168.1.1

I also have

(network-script network-nat)
(vif-script     vif-nat)

enabled in /etc/xen/xend-config.sxp and masquerade set up with iptables:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

From this server I can connect to domU at 192.168.2.2. SSH works, too. After sshing in, I can ping outside hosts like 8.8.8.8 and my own machine at 192.168.1.150.

I'd like to redirect traffic going destined for ssh on 192.168.2.2:22 to another address and port, 192.168.1.20:2022.

This rules don't works:

 iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 2022 -j DNAT --to-destination 192.168.2.2:22

and this:

iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 2022 -j DNAT --to-destination 192.168.2.2:22
iptables -t nat -A POSTROUTING -s 192.168.2.0/255.255.255.0 ! -d 192.168.2.0/255.255.255.0 -p tcp -j MASQUERADE --to-ports 1024-65535
iptables -t nat -A POSTROUTING -s 192.168.2.0/255.255.255.0 ! -d 192.168.2.0/255.255.255.0 -p udp -j MASQUERADE --to-ports 1024-65535
iptables -t nat -A POSTROUTING -s 192.168.2.0/255.255.255.0 ! -d 192.168.2.0/255.255.255.0 -j MASQUERADE 

What should I do? Can I do it with iptables? If so, how?

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.