0

Background: I am running an Openshift installation inside a KVM-VM and I can access the VM from the KVM-Host. I need to access Openshift from another machine. KVM is setup via virtual network using NAT.

  • KVM-Host: 192.168.33.26 (eth0)
  • KVM-Guest: 192.168.100.246 (virbr0 and vnet0)
  • Access from: 192.168.33.50

My first idea was to use port-forwarding with iptables on the KVM-host.

# taken from https://aboullaite.me/kvm-qemo-forward-ports-with-iptables/

# connections from outside
iptables -I FORWARD -o virbr0 -d  192.168.100.246 -j ACCEPT
iptables -t nat -I PREROUTING -p tcp --dport 8443 -j DNAT --to 192.168.100.246:8443
iptables -t nat -A POSTROUTING -p tcp -d 192.168.100.246 --dport 8443 -j SNAT --to-source 192.168.33.26

# Masquerade local subnet
iptables -I FORWARD -o virbr0 -d  192.168.100.246 -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.100.0/24 -j MASQUERADE
iptables -A FORWARD -o virbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i virbr0 -o eth0 -j ACCEPT
iptables -A FORWARD -i virbr0 -o lo -j ACCEPT

Those rules seemed to work (Openshift is answering), but the redirect to the login-page isn't affected by iptables

https://192.168.33.26:8443/console -> redirects to https://192.168.100.246:8443/oauth/authorize wheras it should be https://192.168.33.26:8443/oauth/authorize

As @week pointed out, redirects are managed at application layer and I need a reverse proxy or some routes.

Can someone provide a configuration for nginx (I've read that it can function as a reverse proxy)? Or what is another way to get access to a virtual network?

Improve this question
4
  • 1
    Redirects are given on application layer, by guest, which isn't configured for address 192.168.33.26. I see two ways around, you may add routes for clients accessing and guest or setup a reverse https proxy on host. In both cases there's no need for address translation.
    – week
    Dec 24, 2017 at 1:38
  • @week Thanks for the clarification. I've updated the question
    – lostiniceland
    Dec 24, 2017 at 10:05
  • I would recommend to setup a reverse https proxy on the host. Thus you won't need to use address translation for this action.
    – fopsik
    Dec 28, 2017 at 13:17
  • Actually, the iptables-solution works for my case after making sure the kvm-guest can be accessed via DNS-name (see liquidat.wordpress.com/2017/03/03/… ). After that, I just added an entry to my remote /etc/hosts. A reverse proxy is probably the best solution, but I was not able to get to work due to a https-redirect to a login page.
    – lostiniceland
    Jan 1, 2018 at 10:20

0

Reset to default

You must log in to answer this question.