Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have 2 machines with a KVM running on each machine - so two kvms with the below networking

Host 1: 192.168.10.100 (eth2)
        10.10.100.1 (virbr1)
KVM 1 (NAT with Host 1): 10.10.100.128 (eth0 inside kvm)

Host 2: 192.168.10.101 (eth2)
        10.10.100.1 (virbr1)
KVM 2 (NAT with Host 2): 10.10.100.128 (eth0 inside kvm)

The KVM's are hosting a server, on port 6000. I would like the KVM's to operate both as clients and servers. For example KVM1 could choose to communicate as a client with the server on KVM2 or itself. In this case KVM1 would connect to 192.168.10.101 or 192.168.10.100 (itself)

For this I have the below iptables rules set up, but I am unable to have a KVM communicate with the server running on itself. Can someone help me figure out the missing link?

Both KVM1 and KVM2 have the below rules set up (the below are full rules as they appear on my box):

In the default Table I have set up forwarding to the KVM's network:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
  114  7254 ACCEPT     udp  --  virbr1 *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
    0     0 ACCEPT     tcp  --  virbr1 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53
  314  103K ACCEPT     udp  --  virbr1 *       0.0.0.0/0            0.0.0.0/0            udp dpt:67
    0     0 ACCEPT     tcp  --  virbr1 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:67
6810K 1271M ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22
   43  2723 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8000
  475 60252 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8443
  270 15588 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:111
35125 4776K ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:111
  720  112K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:4001
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:4001
    6   328 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:564
    6   500 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:564
14532 5776K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:2049
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:2049
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:4002
19070 1526K ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:4002
2900K  852M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:6500flags: 0x17/0x02
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:6550flags: 0x17/0x02
 7294  379K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:9000
    0     0 REJECT     all  --  eth0   *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
8574K 1767M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
  934  642K ACCEPT     all  --  *      *       0.0.0.0/0            10.10.100.0/24       state NEW,RELATED,ESTABLISHED
   88  7740 ACCEPT     all  --  *      virbr1  0.0.0.0/0            10.10.100.0/24       state RELATED,ESTABLISHED
  533 39866 ACCEPT     all  --  virbr1 *       10.10.100.0/24       0.0.0.0/0
    0     0 ACCEPT     all  --  virbr1 virbr1  0.0.0.0/0            0.0.0.0/0
    4   240 REJECT     all  --  *      virbr1  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  virbr1 *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT 8939K packets, 2177M bytes)
 pkts bytes target     prot opt in     out     source               destination

In the NAT Table I have set up Port forwarding in PREROUTING and MASQUERADE all packets leaving the virtual interface from the kvm:

Chain PREROUTING (policy ACCEPT 116K packets, 20M bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       tcp  --  *      *      !10.10.100.128        0.0.0.0/0            tcp dpt:8080 to:10.10.100.128:8080
    0     0 DNAT       tcp  --  *      *      !10.10.100.128        0.0.0.0/0            tcp dpt:6002 to:10.10.100.128:6002
    0     0 DNAT       tcp  --  *      *      !10.10.100.128        0.0.0.0/0            tcp dpt:6001 to:10.10.100.128:6001
    0     0 DNAT       tcp  --  *      *      !10.10.100.128        0.0.0.0/0            tcp dpt:6000 to:10.10.100.128:6000

Chain INPUT (policy ACCEPT 114K packets, 20M bytes)
 pkts bytes target     prot opt in     out     source               destination
   54 16928 ACCEPT     all  --  *      *       10.10.100.128        0.0.0.0/0

Chain OUTPUT (policy ACCEPT 7539 packets, 410K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 7537 packets, 410K bytes)
 pkts bytes target     prot opt in     out     source               destination
    2   104 MASQUERADE  all  --  *      virbr1  0.0.0.0/0            0.0.0.0/0
    0     0 MASQUERADE  tcp  --  *      *       10.10.100.0/24      !10.10.100.0/24       masq ports: 1024-65535
    0     0 MASQUERADE  udp  --  *      *       10.10.100.0/24      !10.10.100.0/24       masq ports: 1024-65535
    0     0 MASQUERADE  all  --  *      *       10.10.100.0/24      !10.10.100.0/24

With the above rules, KVM1 can talk to server running on KVM2 but not with the server running on itself. This is because of the PREROUTING rule above that negates any source packet with the KVM's address.

If I change the above PREROUTING rule to:

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
DNAT       tcp  --  anywhere             anywhere             tcp dpt:x11 to:10.10.100.128:6000

In this case the problem is new. Any request from KVM1 to KVM2 is routed internally back to KVM1!

share|improve this question
    
Can you update your output to use the -vnL option to iptables for both nat and default tables. –  mtm May 13 at 7:01
    
Ok. I have added the -vnL option to the default and nat tables to the main question –  nthacker May 13 at 17:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.