I have a machine working like gateway and have two network interfaces:

  • eth0 LAN :
  • eth1 WAN : XXX.XXX.XXX.XXX (my public ip)

This machine has 3 VM guest over virtualbox. All have bridged network and have static IP given by our DNS.

I have the following iptables

    -A FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A FORWARD -i eth0 -o eth1 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

# Rules a webserver VM
    -A PREROUTING -d XXX.XXX.XXX.XXX/32 -i eth1 -p tcp -m tcp --dport 80 -j DNAT --to-destination
    -A POSTROUTING -s  -j SNAT --to-source XXX.XXX.XXX.XXX

I can access the VMs from my LAN, but when I try to access them from the WAN it doesn't work. What is wrong?

  • I assumed eht0 and eht1 were typos for eth0 and eth1 respectively. – Renan Nov 30 '12 at 22:38
  • Does the virtual machine know the "route" map to reply to WAN machines? Please check default router of your virtual machine. – Garfield Carneiro Jan 1 '13 at 8:03

Is it correct to assume that the default policy for FORWARD in the filter table is DROP? (If not, those two filter rules would be pointless because you're accepting everything anyways.)

If that assumption is correct, then your problem is that you're lacking an ACCEPT rule for forwarding new packets to the VM. Add this rule:

iptables -A FORWARD -i eth1 -o eth0 -p tcp -d --dport 80 -j ACCEPT

By the way, the SNAT rule for packets from the VM is redundant - you're already masquerading all packets going out over eth1.

  • the default policity for FORWARD is ACCEPT – rkmax Dec 2 '12 at 6:26
  • i need the SNAT rule cos i have a squid but is not relevant in this case – rkmax Dec 2 '12 at 6:32
  • have you posted your complete iptables ruleset? What's the output of iptables-save? – AGWA Dec 2 '12 at 23:22
  • yeah is a complete ruleset – rkmax Dec 3 '12 at 14:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.