iptables doesn't forward from WAN to virtual machines

Question

I have a machine working like gateway and have two network interfaces:

• eth0 LAN : 192.168.1.0/24
• eth1 WAN : XXX.XXX.XXX.XXX (my public ip)

This machine has 3 VM guest over virtualbox. All have bridged network and have static IP given by our DNS.

I have the following iptables

*filter
    -A FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A FORWARD -i eth0 -o eth1 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

# Rules a webserver VM
*nat
    -A POSTROUTING -o eth1 -j MASQUERADE
    -A PREROUTING -d XXX.XXX.XXX.XXX/32 -i eth1 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.1.100
    -A POSTROUTING -s 192.168.1.100/32  -j SNAT --to-source XXX.XXX.XXX.XXX

I can access the VMs from my LAN, but when I try to access them from the WAN it doesn't work. What is wrong?

Answer 1

Is it correct to assume that the default policy for FORWARD in the filter table is DROP? (If not, those two filter rules would be pointless because you're accepting everything anyways.)

If that assumption is correct, then your problem is that you're lacking an ACCEPT rule for forwarding new packets to the VM. Add this rule:

iptables -A FORWARD -i eth1 -o eth0 -p tcp -d 192.168.1.100 --dport 80 -j ACCEPT

By the way, the SNAT rule for packets from the VM is redundant - you're already masquerading all packets going out over eth1.