1

I have a host machine that has to manage traffic on port 25 and route to port 25 on the KVM machine for postfix deamon like this scheme:

WAN --> (25) HOST_MACHINE -->  (25) KVM_VM_WITH_POSTFIX_DOVECOT

I've already opened port 25 (and others) and added this rule to iptables:

iptables -t nat -A PREROUTING -p TCP --dport 25 -j DNAT --to-destination 192.168.122.201:25

From my laptop now I'm able to connect to the postfix server and send emails but the KVM machine could not connect to others mail servers (connection timed out).

So I've tried out to connect to another mail server from KVM machine with:

telnet mail.example.com 25

With above iptables rule enabled I can't connect. But if I disable it from the chain I can connect to external server.

Where am I wrong?

Improve this question

1 Answer 1

Reset to default
3

Your DNAT rule will route all TCP traffic, received by your KVM host, on port 25, to KVM guest, no matter the interface or destination. You should add either interface or destination IP (or both) in that DNAT:

iptables -t nat -A PREROUTING -i your_pub_if -p TCP --dport 25 -j DNAT --to-destination 192.168.122.201:25

or

iptables -t nat -A PREROUTING -d your_pub_IP/32 -p TCP --dport 25 -j DNAT --to-destination 192.168.122.201:25

or

iptables -t nat -A PREROUTING -i your_pub_if -d your_pub_IP/32 -p TCP --dport 25 -j DNAT --to-destination 192.168.122.201:25
Improve this answer
1
  • 3rd rule worked for me! Thank you!
    – Mirko
    Commented Apr 8, 2015 at 11:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .