2

I'm trying to configure my proxmox server's firewal and redirections. The aim is to block everything, open the necessary ports for basic services to work and, finally, redirect some ports to virtual machines.

In this particular case, I've created a NATed VM using Proxmox and installed Apache on it. From the VM I can access the outer world (apt-get update, for example, works). But when I try to access apache from the outside (ie: when typing "http://my.server.ip" in a browser), the VM onto which I want the flux to be redirected doesn't answer.

Here are the redirections I'd like to implement: - public ip, port 80 -> VM, port 80 - public ip, port 8080 -> VM, port 8080 - public ip, port 443 -> VM, port 443 - public ip, port 2201 -> VM, port 22

Here is the script I use as a ruleset:

#!/bin/bash

PUBLIC_IP=1.2.3.4
VM_SITEWEB=10.0.2.15

# Enable routing
sysctl net.ipv4.ip_forward=1


# Empty any existing rule
iptables -F
iptables -t nat -F

# Remove personnal chains
iptables -X
iptables -t nat -X

# Enable ESTABLISHED and RELATED communications, accepts answers
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Enable ping
iptables -A OUTPUT -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p icmp -m limit --limit 5/s -j ACCEPT

# Enable remote acccess through SSH
iptables -A INPUT -p TCP --dport ssh -j ACCEPT
iptables -A INPUT -p TCP --dport http -j ACCEPT

# ACCEPT DNS
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT

# Web output (HTTP & HTTPS)
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Open ports for proxmox input
iptables -A INPUT -p tcp --dport 8006 -j ACCEPT
iptables -A INPUT -p tcp --dport 5900 -j ACCEPT
iptables -A INPUT -p tcp --dport 5999 -j ACCEPT
iptables -A INPUT -p tcp --dport 3128 -j ACCEPT

# Allow loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT


# Pre-route SSH from 2201 to VM
iptables -A INPUT -p tcp --dport 2201 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp --dport 2201 -j DNAT --to $VM_SITEWEB:22

# Route HTTP(S) to website VM
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to $VM_SITEWEB:80
iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to $VM_SITEWEB:8080
iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to $VM_SITEWEB:443


# Default policy = DROP
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

iptables -A FORWARD -j DROP
iptables -A INPUT -j DROP    
iptables -A OUTPUT -j DROP

Can someone point what's wrong with my script?

2

There is one thing that you didn't configure in your iptables ruleset. You want to forward a port to a specific IP and port but you don't use any FORWARDing rule. The rules you'd need to forward traffic to your Virtual Machine should be.

iptables -A FORWARD -p tcp -s "$PUBLIC_IP" --sport 80 -d "$VM_SITEWEB" –dport 80 -j ACCEPT
iptables -A PREROUTING -t nat -p tcp -s "$PUBLIC_IP" --sport 80 –dport 80 -j DNAT –to "$VM_SITEWEB":80

As a side note: Don't use upper case variable names. Secondly: Always quote variables when writing bash scripts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.