Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a machine working like gateway and have two network interfaces:

  • eth0 LAN : 192.168.1.0/24
  • eth1 WAN : XXX.XXX.XXX.XXX (my public ip)

This machine has 3 VM guest over virtualbox. All have bridged network and have static IP given by our DNS.

I have the following iptables

*filter
    -A FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A FORWARD -i eth0 -o eth1 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

# Rules a webserver VM
*nat
    -A POSTROUTING -o eth1 -j MASQUERADE
    -A PREROUTING -d XXX.XXX.XXX.XXX/32 -i eth1 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.1.100
    -A POSTROUTING -s 192.168.1.100/32  -j SNAT --to-source XXX.XXX.XXX.XXX

I can access the VMs from my LAN, but when I try to access them from the WAN it doesn't work. What is wrong?

share|improve this question
    
I assumed eht0 and eht1 were typos for eth0 and eth1 respectively. –  Renan Nov 30 '12 at 22:38
    
Does the virtual machine know the "route" map to reply to WAN machines? Please check default router of your virtual machine. –  Garfield Carneiro Jan 1 '13 at 8:03

1 Answer 1

up vote 0 down vote accepted

Is it correct to assume that the default policy for FORWARD in the filter table is DROP? (If not, those two filter rules would be pointless because you're accepting everything anyways.)

If that assumption is correct, then your problem is that you're lacking an ACCEPT rule for forwarding new packets to the VM. Add this rule:

iptables -A FORWARD -i eth1 -o eth0 -p tcp -d 192.168.1.100 --dport 80 -j ACCEPT

By the way, the SNAT rule for packets from the VM is redundant - you're already masquerading all packets going out over eth1.

share|improve this answer
    
the default policity for FORWARD is ACCEPT –  rkmax Dec 2 '12 at 6:26
    
i need the SNAT rule cos i have a squid but is not relevant in this case –  rkmax Dec 2 '12 at 6:32
    
have you posted your complete iptables ruleset? What's the output of iptables-save? –  AGWA Dec 2 '12 at 23:22
    
yeah is a complete ruleset –  rkmax Dec 3 '12 at 14:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.