0

I have an Ubuntu Server 14.04 running VirtualBox with some machines. These machines are OpenStack Fuel installed and I cannot change the NIC interfaces infra ( two hostonly and one NAT ).

One of these machines is running the Fuel Control panel, but accessible only by one of the hostonly interfaces ( 10.20.0.2 ).

My home network is 192.168.25.x. The host machine ( Ubuntu ) external is 192.168.25.25.

Now I have a Windows machine in my home network and need to access the Fuel panel running in the VM (IP 10.20.0.2).

What I need is forward the incomming from hardware 192.168.25.25 interface to the virtualbox hostonly 10.20.0.X VM interface to reach the IP 10.20.0.2.

This is my host ifconfig showing all interfaces:

root@AKRAB:~# ifconfig
lo        Link encap:Loopback Local
          inet end.: 127.0.0.1  Masc:255.0.0.0
          endereço inet6: ::1/128 Escopo:Máquina
          UP LOOPBACK RUNNING  MTU:65536  Métrica:1
          pacotes RX:19685 erros:0 descartados:0 excesso:0 quadro:0
          Pacotes TX:19685 erros:0 descartados:0 excesso:0 portadora:0
          colisões:0 txqueuelen:0
          RX bytes:7674590 (7.6 MB) TX bytes:7674590 (7.6 MB)

vboxnet0  Link encap:Ethernet  Endereço de HW 0a:00:27:00:00:00
          inet end.: 10.20.0.1  Bcast:10.20.0.255  Masc:255.255.255.0
          endereço inet6: fe80::800:27ff:fe00:0/64 Escopo:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Métrica:1
          pacotes RX:0 erros:0 descartados:0 excesso:0 quadro:0
          Pacotes TX:167 erros:0 descartados:0 excesso:0 portadora:0
          colisões:0 txqueuelen:1000
          RX bytes:0 (0.0 B) TX bytes:22260 (22.2 KB)

vboxnet1  Link encap:Ethernet  Endereço de HW 0a:00:27:00:00:01
          inet end.: 172.16.0.254  Bcast:172.16.0.255  Masc:255.255.255.0
          endereço inet6: fe80::800:27ff:fe00:1/64 Escopo:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Métrica:1
          pacotes RX:0 erros:0 descartados:0 excesso:0 quadro:0
          Pacotes TX:437 erros:0 descartados:0 excesso:0 portadora:0
          colisões:0 txqueuelen:1000
          RX bytes:0 (0.0 B) TX bytes:137886 (137.8 KB)

vboxnet2  Link encap:Ethernet  Endereço de HW 0a:00:27:00:00:02
          inet end.: 172.16.1.1  Bcast:172.16.1.255  Masc:255.255.255.0
          endereço inet6: fe80::800:27ff:fe00:2/64 Escopo:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Métrica:1
          pacotes RX:0 erros:0 descartados:0 excesso:0 quadro:0
          Pacotes TX:464 erros:0 descartados:0 excesso:0 portadora:0
          colisões:0 txqueuelen:1000
          RX bytes:0 (0.0 B) TX bytes:150336 (150.3 KB)

wlan0     Link encap:Ethernet  Endereço de HW 00:13:46:94:18:c1
          inet end.: 192.168.25.25  Bcast:192.168.25.255  Masc:255.255.255.0
          endereço inet6: fe80::213:46ff:fe94:18c1/64 Escopo:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Métrica:1
          pacotes RX:2354945 erros:0 descartados:4 excesso:0 quadro:0
          Pacotes TX:1237088 erros:0 descartados:0 excesso:0 portadora:0
          colisões:0 txqueuelen:1000
          RX bytes:3455421823 (3.4 GB) TX bytes:103231994 (103.2 MB)

root@AKRAB:~#

You can see the wlan0 external interface (my home network) and the vboxnet0 hiding the network I want to go to ( 10.20.0.2 ).

All these addresses are static including the target. The port number I want to reach in the VM is 8443 (Mirantis Fuel Dashboard).

Tried this with no success:

root@AKRAB:~# iptables -I FORWARD -d 10.20.0.2 -m comment --comment "Accept to forward Fuel DashBoard traffic" -m tcp -p tcp --dport 8443 -j ACCEPT
root@AKRAB:~# iptables -t nat -I PREROUTING -m tcp -p tcp --dport 8443 -m comment --comment "redirect pkts to virtual machine" -j DNAT --to-destination 10.20.0.2:8443
root@AKRAB:~# iptables -t nat -I POSTROUTING -m comment --comment "NAT the src ip" -d 10.20.0.2 -o vboxnet0 -j MASQUERADE

Results:

root@AKRAB:~# iptables -nvL FORWARD
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     tcp  --  *      *       10.20.0.2            0.0.0.0/0            /* Accept to forward Fuel DashBoard return traffic */ tcp spt:8443
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            10.20.0.2            /* Accept to forward Fuel DashBoard traffic */ tcp dpt:8443

And

root@AKRAB:~# iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 73 packets, 6145 bytes)
 pkts bytes target     prot opt in     out     source               destination
   18   912 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8443 /* redirect pkts to virtual machine */ to:10.20.0.2:8443

Chain INPUT (policy ACCEPT 73 packets, 6145 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 759 packets, 47828 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 759 packets, 47828 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 MASQUERADE  all  --  *      vboxnet0  0.0.0.0/0            10.20.0.2            /* NAT the src ip */

closed as off-topic by Kusalananda, Networker, Anthon, slm Aug 1 '16 at 3:47

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question has been posted on multiple sites. Cross-posting is strongly discouraged; see the help center and community FAQ for more information." – Kusalananda, Networker, Anthon, slm

  • If you do "iptables -nvL FORWARD" and "iptables -t nat -nvL" you see that the rule are matched? (in the first column you have the packets count). Have you enabled the ip forward? – DarkVex Jul 31 '16 at 21:03
  • Thanks for reply. See my edit for outputs. I think I missunderstood something in the tutorial I've got. Just do a monkey-like-copy-paste with value changes. Can you check it? And yes, the port value actualy is 8443. – Magno C Jul 31 '16 at 21:25
  • Huh? Ip forwarding? nop. I just done the 3 lines of code in my "Tried this with no success:" area. – Magno C Jul 31 '16 at 21:32
  • After echo 1 > /proc/sys/net/ipv4/ip_forward now I've got a 400 Bad Request - The plain HTTP request was sent to HTTPS port - nginx error... Now iptables -nvL FORWARD is showing some packets values!! – Magno C Jul 31 '16 at 21:34
  • "400 Bad Request - The plain HTTP request was sent to HTTPS port" means that you have called the URL with http instead of https – DarkVex Jul 31 '16 at 21:39
2

The iptables rules seems to be ok but probably you missed to enable the ip forward, try with:

echo 1 > /proc/sys/net/ipv4/ip_forward

then check if the iptables rules are matched with:

iptables -t nat -nvL
iptables -nvL FORWARD
  • how can I make this permanent? Will clean iptables after boot? – Magno C Jul 31 '16 at 21:45
  • comment out "net.ipv4.ip_forward=1" under /etc/sysclt.conf about iptables yes also the rule are flushed at boot – DarkVex Jul 31 '16 at 21:48
  • There is no /etc/sysclt.conf file in my Ubuntu 14.04. Why the rules will be gone after boot? I need to recreate them every time I boot my system? – Magno C Jul 31 '16 at 21:50
  • sorry I have done a typo! the file is /etc/sysctl.conf :) about iptables you can follow this askubuntu.com/questions/66890/… – DarkVex Jul 31 '16 at 21:50
  • The file is empty anyway. Must I write this line inside it? – Magno C Jul 31 '16 at 21:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.