iptables and virtual machines of KVM, no ping, no ssh from VMs

Question

Hi everyone :) I have two virtual machines KVM. I did two alias to eth0 - eth0:0 and eth0:1 and put them on an external IPs (eth0:0 - 89.114.122.3, eth0:1 - 89.114.122.4)​​. Now the problem is: redirect from IP 89.114.122.3 and 89.114.122.4 IPs to virtual internal addresses (virbr0 bridge) of VMs obtained for dhcp ... I do like this:

Host_address=89.114.122.3

Host_port=23

Guest_ipaddr=192.168.122.86

Guest_port=23

iptables -t nat -A PREROUTING -p tcp -d ${Host_address} --dport ${Host_port} -j DNAT \ --to ${Guest_ipaddr}:${Guest_port}

iptables -I FORWARD -d ${Guest_ipaddr}/32 -p tcp -m state --state NEW \ -m tcp --dport ${Guest_port} -j ACCEPT

based on the manual script: http://wiki.libvirt.org/page/Networking#NAT_forwarding_.28aka_.22virtual_networks.22.29

and from WAN my VMs looks good, but if i do this in VM session:

deploy@bothunter:~$ telnet domain.in 23 Trying 89.114.122.3... Connection time out

What's wrong?

Answer 1

Well, I understood, what's wrong: I have a route: 89.114.150.3 (eth0:0)->192.168.122.1(virbr0)->192.168.122.5(vint0). And I rewrite my route in iptables so:

iptables -t nat -A PREROUTING -p tcp -d 89.114.150.3 --dport 80 -j DNAT --to 192.168.122.1:80
iptables -t nat -A PREROUTING -p tcp -d 192.168.122.1 --dport 80 -j DNAT --to 192.168.122.5:80

iptables -I FORWARD -d 192.168.122.5/32 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT

iptables -t nat -A POSTROUTING -p tcp -s 192.168.122.5 --sport 80 -j SNAT --to-source 192.168.122.1 iptables -t nat -A POSTROUTING -p tcp -s 192.168.122.1 --sport 80 -j SNAT --to-source 89.114.150.3

But I have new problem - this is also not working... Why?