1

I have a Debian host and a ubuntu guest. I want to connect to the webserver (port 80) from outside with port 8055. I tried this "hack" http://wiki.libvirt.org/page/Networking#Forwarding_Incoming_Connections but it didn't work. Then I tried manually iptables:

iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 8055 -j DNAT --to-destination 192.168.122.234:80
iptables -A FORWARD -p tcp -d 192.168.122.234 --dport 8080 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Nothing worked. I don't know what else I can share with you.

root@ms532:~#  iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     udp  --  anywhere             anywhere             udp dpt:domain
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:domain
ACCEPT     udp  --  anywhere             anywhere             udp dpt:bootps
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:bootps

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             192.168.122.0/24     state NEW,RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             192.168.122.234      state NEW tcp dpt:9901
ACCEPT     tcp  --  anywhere             192.168.122.234      state NEW tcp dpt:http
ACCEPT     all  --  anywhere             192.168.122.0/24     ctstate RELATED,ESTABLISHED
ACCEPT     all  --  192.168.122.0/24     anywhere
ACCEPT     all  --  anywhere             anywhere
REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable
REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable
ACCEPT     all  --  anywhere             192.168.122.0/24     state NEW,RELATED,ESTABLISHED

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     udp  --  anywhere             anywhere             udp dpt:bootpc
1
  • Your forward rule is messed up and unneeded. You should instead set up a POSTROUTING rule on the nat table for replies to get sent back to the local Ethernet interface. Commented Aug 26, 2016 at 23:20

0

You must log in to answer this question.

Browse other questions tagged .