Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a dedicated server with a single public IP (Say 1.2.3.4) running CentOS. Via virt-manager, I added a virtual machine, running CentOS as well.

They are connected through a virtual network:

  • Host is on 192.168.100.1
  • Guest is on 192.168.100.2

My goal is to set up a TeamSpeak server on the Guest, accessible by the Host's public IP.

Browsing forums, I ended up with those rules :

iptables -t nat -A PREROUTING -p udp --dport 9987 -j DNAT --to 192.168.100.2:9987
iptables -I FORWARD -d 192.168.100.2 -p udp -m state --state NEW,RELATED,ESTABLISHED -m udp --dport 9987 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 30033 -j DNAT --to 192.168.100.2:30033
iptables -I FORWARD -d 192.168.100.2 -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --dport 30033 -j ACCEPT
iptables -t nat -A PREROUTING -p udp --dport 30033 -j DNAT --to 192.168.100.2:30033
iptables -I FORWARD -d 192.168.100.2 -p udp -m state --state NEW,RELATED,ESTABLISHED -m udp --dport 30033 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 10011 -j DNAT --to 192.168.100.2:10011
iptables -I FORWARD -d 192.168.100.2 -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --dport 10011 -j ACCEPT

Unfortunately, I get no response when trying to connect using TeamSpeak.

Would you please enlighten me ?

------------------------------------ EDIT ------------------------------------

Running "tcpdump -i eth0 -n udp port 9987" on both machines, I can see forwarded packets.

vi /etc/sysctl.conf

net.ipv4.ip_forward = 1

netstat -an|grep -w 9987

udp        0      0 0.0.0.0:9987                0.0.0.0:*

LOG all -- anywhere anywhere limit: avg 10/sec burst 5 LOG level warning

Jun 21 04:17:07 sd-xxxxx kernel: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:0c:c4:7a:08:xx:xx:xx:xx SRC=62.xx.xx.52 DST=62.xx.xx.255 LEN=49 TOS=0x00 PREC=0x00 TTL=64 ID=45280 DF PROTO=UDP SPT=47579 DPT=32414 LEN=29 
Jun 21 04:17:09 sd-xxxxx kernel: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:0c:c4:7a:09:xx:xx:xx:xx SRC=62.xx.xx.188 DST=255.255.255.255 LEN=201 TOS=0x00 PREC=0x00 TTL=64 ID=65 DF PROTO=UDP SPT=55996 DPT=1900 LEN=181

I found rule for port 9987 isn't described the same way in iptables -L 's FORWARD block

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
LOG        all  --  anywhere             anywhere            limit: avg 10/sec burst 5 LOG level warning 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             192.168.100.2       state NEW,RELATED,ESTABLISHED tcp dpt:10011 
ACCEPT     udp  --  anywhere             192.168.100.2       state NEW,RELATED,ESTABLISHED udp dpt:30033 
ACCEPT     tcp  --  anywhere             192.168.100.2       state NEW,RELATED,ESTABLISHED tcp dpt:30033 
ACCEPT     udp  --  anywhere             192.168.100.2       state NEW,RELATED,ESTABLISHED udp dpt:dsm-scm-target 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Got no log adding the rules below, neither on Host nor on Guest

iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A LOGGING -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
iptables -A LOGGING -j DROP
share|improve this question
    
Did you enable routing/IP forwarding on the host ? –  Iain Jun 21 at 7:06
    
Is there a firewall running on the host? –  MadHatter Jun 21 at 7:09
    
@Iain I set net.ipv4.ip_forward = 1 in /etc/sysctl.conf and restarted Host. Is it what you mean ? –  Vincent Jun 21 at 8:23
    
@MadHatter Host is running iptables with aforementioned rules. Iptables service is stopped on Guest –  Vincent Jun 21 at 8:24
2  
@Vincent: Please include the log inside your question, it's really hard to read in the comments. –  Jenny D Jun 21 at 9:27
show 7 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.