Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I use NAT to move requests from external ports to an internal ip address and port hosted with proxmox.

Something like this:

iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 8000 -j DNAT --to 10.0.0.1:80

However even when I try to temporarily block port 8000 the requests still go through and I can access the web pages.

Can you not block ports on the host machine when using NAT? Do I have to do this on the virtual machine? Is this just the wrong command? ufw deny 8000

share|improve this question

1 Answer 1

You're using portforwarding in the PREROUTING chain, so you have to use Port blocking in the FORWARD chain on the host system or block the port in the INPUT chains of the guest system.

But it's easier to delete the portfording rule to make the website inaccessible

Look at this chart to understand how the IPTables Chain Order works:

http://www.ironflake.org/wp-content/uploads/2011/02/Linux_IptablesSchema.png

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.