Thank you all in advanced!
So here is the situation:
1. domain0 has two NICs (LAN=enp1s0f0, WAN=enp1s0f1)
2. vm0 of domain0 has IP=10.4.4.10
3. ip_forward=1 AND all interfaces forwarding=1
4. PREROUTING WAN(dhcp from ISP) -->interface<-- DNAT to 10.4.4.10
5. PREROUTING WAN(dhcp from ISP) -->IP<-- DNAT to 10.4.4.10
The problem is !LAN! HTTP traffic to domain.com fails with (4) above.
And !LAN! HTTP traffic to domain.com succeeds with (5) above.
It would be nice to:
${IPTABLES} -t nat -A PREROUTING ${STATE_NEW_TCP} -p tcp -i ${if_WAN} --dport 80 -j DNAT --to-destination ${ip_VM0}:80 ${IPTABLES} -t nat -A PREROUTING ${STATE_NEW_UDP} -p udp -i ${if_WAN} --dport 80 -j DNAT --to-destination ${ip_VM0}:80
But this only works:
MY_IP=22.22.222.22/24
${IPTABLES} -t nat -A PREROUTING ${STATE_NEW_TCP} -p tcp -d ${MY_IP} --dport 80 -j DNAT --to-destination ${ip_VM0}:80 ${IPTABLES} -t nat -A PREROUTING ${STATE_NEW_UDP} -p udp -d ${MY_IP} --dport 80 -j DNAT --to-destination ${ip_VM0}:80
Q. What is the correct way to get !LAN traffic! to domain.com (website hosted on VM0)?
Currently iptables is PREROUTING DNAT forwarding from (dhcp assigned from ISP) WAN interface to virtual machine.
Any help appreciated. :)
Note: Using CentOS 7 (1611)
((RESULTS FILTERED)) = Providing only information related to question.
Chain INPUT (policy DROP 2 packets, 120 bytes) ((RESULTS FILTERED)) pkts bytes target prot opt in out source destination 0 0 ACCEPT tcp -- enp1s0f1 * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:80 0 0 ACCEPT udp -- enp1s0f1 * 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:80 0 0 ACCEPT tcp -- * * 0.0.0.0/0 10.4.4.10 state NEW tcp dpt:80 0 0 ACCEPT udp -- * * 0.0.0.0/0 10.4.4.10 state NEW udp dpt:80 Chain FORWARD (policy DROP 0 packets, 0 bytes) ((RESULTS FILTERED)) pkts bytes target prot opt in out source destination 0 0 ACCEPT tcp -- enp1s0f1 * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:80 0 0 ACCEPT udp -- enp1s0f1 * 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:80 0 0 ACCEPT tcp -- * * 0.0.0.0/0 10.4.4.10 state NEW tcp dpt:80 0 0 ACCEPT udp -- * * 0.0.0.0/0 10.4.4.10 state NEW udp dpt:80 Chain PREROUTING (policy ACCEPT 7 packets, 689 bytes) ((RESULTS FILTERED)) pkts bytes target prot opt in out source destination 0 0 DNAT tcp -- enp1s0f1 * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:80 to:10.4.4.10:80 0 0 DNAT udp -- enp1s0f1 * 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:80 to:10.4.4.10:80 1 60 DNAT tcp -- * * 0.0.0.0/0 22.22.222.22 state NEW tcp dpt:80 to:10.4.4.10:80 0 0 DNAT udp -- * * 0.0.0.0/0 22.22.222.22 state NEW udp dpt:80 to:10.4.4.10:80 Chain POSTROUTING (policy ACCEPT 22181 packets, 1435K bytes) pkts bytes target prot opt in out source destination 338K 73M MASQUERADE all -- * enp1s0f1 10.2.2.0/24 0.0.0.0/0 16549 1086K MASQUERADE all -- * enp1s0f1 10.4.4.0/24 0.0.0.0/0 domain0$ ip a ((RESULTS FILTERED)) 2: enp1s0f0: mtu 1500 qdisc mq state UP qlen 1000 link/ether XX:XX:XX:XX:XX:XX brd ff:ff:ff:ff:ff:ff inet 10.2.2.1/24 brd 10.2.2.255 scope global enp1s0f0 valid_lft forever preferred_lft forever 3: enp1s0f1: mtu 1500 qdisc mq state UP qlen 1000 link/ether XX:XX:XX:XX:XX:XX brd ff:ff:ff:ff:ff:ff inet 22.22.222.22/24 brd 255.255.255.255 scope global dynamic enp1s0f1 valid_lft 87813sec preferred_lft 87813sec 4: xenbr0: mtu 1500 qdisc noqueue state UP qlen 1000 link/ether fe:ff:ff:ff:ff:ff brd ff:ff:ff:ff:ff:ff inet 10.4.4.1/24 brd 10.4.4.255 scope global xenbr0 valid_lft forever preferred_lft forever 9: vm0-emu: mtu 1500 qdisc pfifo_fast master xenbr0 state UNKNOWN qlen 1000 link/ether fe:ff:ff:ff:ff:ff brd ff:ff:ff:ff:ff:ff 10: vm0: mtu 1500 qdisc mq master xenbr0 state UP qlen 32 link/ether fe:ff:ff:ff:ff:ff brd ff:ff:ff:ff:ff:ff domain0$ brctl show bridge name bridge id STP enabled interfaces xenbr0 8000.feffffffffff no vm0 vm0-emu domain0$ cat /proc/sys/net/ipv4/ip_forward 1 domain0$ cat /proc/sys/net/ipv4/conf/*/forwarding ((RESULTS FILTERED)) 1 1 1 1 1 1 1 domain0$ ls /proc/sys/net/ipv4/conf/ -l ((RESULTS FILTERED)) dr-xr-xr-x. 1 root root 0 May 2 15:31 all dr-xr-xr-x. 1 root root 0 May 2 15:31 default dr-xr-xr-x. 1 root root 0 May 2 18:08 vm0 dr-xr-xr-x. 1 root root 0 May 2 18:08 vm0-emu dr-xr-xr-x. 1 root root 0 May 2 15:31 enp1s0f0 dr-xr-xr-x. 1 root root 0 May 2 15:31 enp1s0f1 dr-xr-xr-x. 1 root root 0 May 2 15:31 xenbr0 domain0$ uname -a ((RESULTS FILTERED)) Linux hostname 4.9.13-22.el7.x86_64 #1 SMP Sun Feb 26 22:15:59 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux vm0$ ip a 2: eth0: mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff inet 10.4.4.10/24 brd 10.4.4.255 scope global eth0