Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What's wrong with this set-up? Both host and guest are CentOS 6.5

Specifically, I can't run yum on the guest.

I can ping happily to/from the guest, including pinging mirrorlist.centos.org

If I remove the port 80 rule from the host iptables (see below) then yum works fine. But I need that rule in place so I can use the guest as a publicly-accessible webserver.

yum update output:

Loaded plugins: fastestmirror
Determining fastest mirrors
Could not retrieve mirrorlist http://mirrorlist.centos.org/?release=6&arch=x86_64&repo=os error was
12: Timeout on http://mirrorlist.centos.org/?release=6&arch=x86_64&repo=os: (28, 'connect() timed out!')
Error: Cannot find a valid baseurl for repo: base

Guest has an IP of 192.168.122.47, and the ssh port forwarding I have set up below works, but yum does not.

Guest iptables has been disabled.

Host iptables:

# Generated by iptables-save v1.4.7 on Sat May 10 15:54:24 2014
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [4:560]
-A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -d 192.168.122.0/24 -o virbr0 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
-A FORWARD -i virbr0 -o virbr0 -j ACCEPT
-A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Sat May 10 15:54:24 2014
# Generated by iptables-save v1.4.7 on Sat May 10 15:54:24 2014
*mangle
:PREROUTING ACCEPT [4:316]
:INPUT ACCEPT [4:316]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [4:560]
:POSTROUTING ACCEPT [4:560]
-A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
COMMIT
# Completed on Sat May 10 15:54:24 2014
# Generated by iptables-save v1.4.7 on Sat May 10 15:54:24 2014
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A PREROUTING -p tcp -m tcp --dport 792 -j DNAT --to-destination 192.168.122.47:22
-A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.122.47:80
-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
COMMIT
# Completed on Sat May 10 15:54:24 2014
share|improve this question

1 Answer 1

up vote 3 down vote accepted

You are over-NATting; you are NATting not just inbound connections to port 80, but outbound ones as well. Modify the NAT rule to specify that the traffic must be coming in from outside, eg

-A PREROUTING -p tcp -m tcp -i eth0 --dport 80 -j DNAT --to-destination 192.168.122.47:80

and it will stop matching (and interfering with) legitimate outbound traffic to external webservers.

share|improve this answer
    
Thank you, I'm yet to really get my head around iptables - need to spend some time reading up and playing around rather than just copying and pasting from google... –  Codemonkey May 10 at 15:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.