I have an Ubuntu box acting as both a NAT gateway as well as hosting KVM virtual machines. I followed a guide to use the libvirt qemu hook to forward ports to one of the KVM VMs, but this seems to also be hijacking outgoing connections to those ports from any of the NAT'd boxes.
eno0 = 192.168.70.1 = Internal interface on NAT gateway
eno1 = 10.240.45.45 = External interface on NAT gateway
virbr0 = 192.168.122.1 = Bridge for KVM VMs
KVM Guest IP = 192.168.122.81
/etc/libvirt/hooks/qemu:
if [ "${1}" = "myvm" ]; then
GUEST_IP=192.168.122.81
if [ "${2}" = "stopped" ] || [ "${2}" = "reconnect" ]; then
/sbin/iptables -D FORWARD -o virbr0 -d $GUEST_IP -j ACCEPT
/sbin/iptables -t nat -D PREROUTING -p tcp -d 10.240.45.45 --dport 443 -j DNAT --to $GUEST_IP:443
fi
if [ "${2}" = "start" ] || [ "${2}" = "reconnect" ]; then
/sbin/iptables -I FORWARD -o virbr0 -d $GUEST_IP -j ACCEPT
/sbin/iptables -t nat -A PREROUTING -p tcp -d 10.240.45.45 --dport 443 -j DNAT --to $GUEST_IP:443
fi
fi
This does correctly forward traffic from any external hosts pointing at 10.240.45.45. However, if I try to go to any HTTPS page (including https://google.com) from a system behind the NAT, it gets hijacked and redirected to the VM instead of going to the external host.
Why is it ignoring the -d parameter and how can I make this only forward traffic meant for 10.240.45.45?