iptables: add routing for internal guests and port forwarding [closed]

Question

I have the following rules working fine - before I added a private network with a single VM (which can ping all machines on the host but not the outside). I want the VM (192.168.100.2) to reach the internet and enable a forwarding so I can connect to it via SSH. (Which only works without my rules I already have) IP forwarding is enabled.

The iptables rules I have so far:

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1:152]
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables    INPUT:DROP: "
-A INPUT -j DROP
-A FORWARD -m physdev --physdev-is-bridged -j ACCEPT
-A OUTPUT -p icmp -j ACCEPT
COMMIT

When ever I load the above rules and then load the following, the internal VM cannot reach the internet - but I can connect to it via the port forwarding:

iptables -t nat -A POSTROUTING -s 192.168.100.0/24 -o br0 -j MASQUERADE
iptables -t nat -A PREROUTING -p tcp -i br0 --dport 22727 -j DNAT --to-destination 192.168.100.2:2727
iptables -A FORWARD -p tcp -d 192.168.100.2 --dport 22727 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Any hints what I am missing?

Answer 1

The problem might be that web packets returning from the internet are dropped by the INPUT chain, as the dport is a random one (and not always 22727)

You can try with:

iptables -I INPUT 2 -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT

EDIT:

You also need to enable ip forwarding

echo 1 > /proc/sys/net/ipv4/ip_forward