0

TL;DR: I want to access port 443 at the host IP address from within a VM on the same host, and have my request forwarded to a different VM on the same host.

I am using Libvirt to manage some VMs running on QEMU/KVM on a Debian 9 host. I have used Libvirt to configure a NAT network (subnet 192.168.122.0/24 with gateway 192.168.122.1) and have a hook script that sets the following iptables rules:

iptables -D FORWARD -m state -d 192.168.122.0/24 --state NEW,RELATED,ESTABLISHED -j ACCEPT
iptables -t nat -D PREROUTING -p tcp -d 192.168.0.2 --dport 443 -j DNAT --to-destination 192.168.122.128:443

They essentially port-forward connections to the host port to the guest. These allow the service running on port 443 of the VM at 192.168.122.128 to be accessible via the external IP of the host (192.168.0.2) on 443.

I want to be able to access the port-forwarded services (either 192.168.0.2:443 or 192.168.122.1:443) from VMs running on the same host. Currently, my requests are not forwarded when I access port 443 on a VM on the same NAT network.

How can I port-forward from host to guest and guest to guest using iptables?

  • Why are you doing this? The two VMs can just talk directly. – Michael Hampton Feb 18 at 21:31
  • @MichaelHampton Because I need to use a single hostname to access all the services running on each guest. I could have them communicate directly but that would require more certificates, changing /etc/hosts... and so on. – wispi Feb 18 at 21:41
  • It's not accepting connections from the Internet, though? Just put it in /etc/hosts on the host, and go on with your life. – Michael Hampton Feb 18 at 21:42
  • @MichaelHampton But I need to use a single hostname to access multiples guests on different ports. ie. I have a webserver on guest 192.168.122.4 and a K8s cluster 192.168.122.7 and they both need to use the same hostname. – wispi Feb 18 at 21:53
  • How can you possibly tell them apart, then? Port forwarding won't fix that. – Michael Hampton Feb 18 at 21:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.