I have a dedicated server running KVM virtualization with n public IP addresses dedicated to n-1 web-facing virtual machines. Now I'd like to set up some web-facing VM's that don't have a dedicated address, but instead will have 2 or 3 ports forwarded for them from the host machine.
Bridge configuration is:
Let's say I would like to forward
- 22.214.171.124:201 to 192.168.1.101:22
- 126.96.36.199:801 to 192.168.1.101:80
First, I have enabled port forwarding on a host machine by uncommenting
/etc/sysctl.conf, then I did
sysctl -p /etc/sysctl.conf service network restart
Then, similar to the recipe in this question, I did:
iptables -t nat -A PREROUTING -p tcp -i br0 --dport 201 -j DNAT --to-destination 192.168.1.101:22 iptables -A FORWARD -p tcp -d 192.168.1.101 --dport 201 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT iptables -t nat -A PREROUTING -p tcp -i br0 --dport 801 -j DNAT --to-destination 192.168.1.101:80 iptables -A FORWARD -p tcp -d 192.168.1.101 --dport 801 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
ifconfig on a guest machine and checked that its interface eth0, indeed, has the IP address 192.168.1.101. The interface inside of virtual machine is called
eth0, is this right?
But it doesn't work:
nmap 188.8.131.52 doesn't show an open port 201 nor 801, and
ssh -l root -p 201 184.108.40.206 gets me
ssh: connect to host 220.127.116.11 port 201: Connection refused
ip route on a host machine returns
18.104.22.168/26 dev br0 proto kernel scope link src 22.214.171.124 192.168.122.0/24 dev virbr0 proto kernel scope link src 192.168.122.1 169.254.0.0/16 dev br0 scope link metric 1004 default via 126.96.36.199 dev br0
What am I doing wrong?