0

I have a server with a IP 1.0.0.5/24. This is the main IP address of the server, and now I have two other IP addresses for the server, they are 1.0.2.30/24 and 1.0.2.31/24. I want to make a VirtualBox running another OS accessible through the Internet, and only allow the specified IP to reach the virtual box.

I'm new to iptables and therefore I need some basic help and getting started information about this.

The hosting provider does not allow more than on MAC address per switch port, which means that I'm not able to make bridge as far as I know.

Futhermore I want the host, to reject the extra IPs so its only the VirtualBox / virtual machine that accepts the request's on the extra IPS.

1
  • I hope you're not actually using 1.0.0.0/8 as internal addresses. Commented May 31, 2012 at 2:13

1 Answer 1

2

I haven't tested this, but this is what I would try.

  1. Create a new bridge on the host with brctl

    brctl addbr br0
    
  2. Configure the VM with bridged networking connected to this bridge

  3. Assign a private subnet to the bridge and give the host an IP on it

    ip addr add 192.168.1.1/24 dev br0
    ip route add 192.168.1.0/24 dev br0
    
  4. Either statically configure the VM with an IP on this range (e.g. 192.168.1.2), or setup a DHCP server on the host (e.g. dnsmasq or VirtualBox's dhcpserver).

  5. Check that the host can access the VM and vice versa on the private IPs
  6. Attach the static IP to eth0 on the host

    ip addr add 1.0.2.30/24 dev eth0
    
  7. Check that you can connect to the host on the additional IP from outside

  8. Enable IP forwarding on the host

    echo 1 > /proc/sys/net/ipv4/ip_forward
    
  9. Configure iptables to SNAT outgoing packets from the VM

    iptables --table nat --append POSTROUTING --source 192.168.1.0/24 --jump SNAT --to 1.0.2.30
    iptables --append FORWARD --source 192.168.1.0/24 --jump ACCEPT
    
  10. Check that the VM has connectivity to the Internet

  11. Configure iptables to DNAT packets to the additional IP to the VM

    iptables --table nat --append PREROUTING --destination 1.0.2.30 --to-destination 192.168.1.2
    iptables --append FORWARD --destination 192.168.1.2 --jump ACCEPT
    
  12. Check that you can connect to the VM on the additional IP from outside

6
  • I will give it a try later when i got the time for it. :)
    – Klaes S.
    Commented Jun 8, 2012 at 15:36
  • It worked like a charm though i had to add, some information in the iptables line.
    – Klaes S.
    Commented Jun 13, 2012 at 11:10
  • But the VM is actually not able to make any connection from the inside to the outside, but able to make connection to the host machine, Any solution to this problem ?
    – Klaes S.
    Commented Jun 13, 2012 at 11:17
  • @KlaesS. You also need SNAT on outgoing packets, I've updated my answer.
    – mgorven
    Commented Jun 13, 2012 at 16:57
  • Yes i can see that but now it seems not to work.. but i will try to dig into it and see if i have made a TYPO somewhere.
    – Klaes S.
    Commented Jun 14, 2012 at 14:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .