0

On a hypervisor with multiple public IPs on a single network interface, there are two groups of Virtual Machines.

  • Group A members get their public IP routed to them directly via the host interface (via a bridge that sets up the route). [1]
  • Group B members are on a bridge with NAT configuration, so they get private IPs, and their connections get NAT'ed through one specific public IP. Let's call this shared address IPb. [2]

For incoming connections on IPb some ports are forwarded to some Group B members. The problem I'm having is that the DNAT (port forwarding) rules are getting applied to incoming packets not only over IPb, but also from any other public IP.

How can I restrict the DNAT rule to be specific to packets directed only to IPb?

I tried -dst IPb in the PREROUTING rule, but this practically caused the rule to not get triggered at all (port forwarding stopped). [3]

Thank you

[1]
auto eth0
iface eth0 inet static
        address <eth0-main-ip>/32
        gateway <gateway-ip>
        pointopoint <gateway-ip>

#GroupA Bridge:
auto vmbr12
iface vmbr12 inet static
        address <eth0-main-ip>/32
        bridge-ports none
        bridge-stp off
        bridge-fd 0
        up   ip route add <Public-IPa>/32 via <eth0-main-ip> dev vmbr12
        down ip route del <Public-IPa>/32 via <eth0-main-ip> dev vmbr12
        .
        .
        .
[2]
#GroupB Bridge:
auto vmbr4
iface vmbr4 inet static
        address 10.0.0.1/16
        bridge-ports none
        bridge-stp off
        bridge-fd 0
        post-up echo 1 > /proc/sys/net/ipv4/ip_forward

        post-up iptables -t nat -A POSTROUTING -s '10.0.0.0/16' -o eth0 -j MASQUERADE
        post-up iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 22 -j DNAT --to 10.0.101.1:22
        post-up iptables -A FORWARD -p tcp -d 10.0.101.1 --dport 22 -j ACCEPT

        post-down iptables -t nat -D POSTROUTING -s '10.0.0.0/16' -o eth0 -j MASQUERADE
        post-down iptables -D PREROUTING -t nat -i eth0 -p tcp --dport 22 -j DNAT --to 10.0.101.1:22
        post-down iptables -D FORWARD -p tcp -d 10.0.101.1 --dport 22 -j ACCEPT

        .
        .
        .
[3]
#Using IPb in PREROUTING rule
<snip>
        post-up iptables -t nat -A POSTROUTING -s '10.0.0.0/16' -o eth0 -j MASQUERADE
        post-up iptables -A PREROUTING -t nat -i eth0 -p tcp -dst IPb --dport 22 -j DNAT --to 10.0.101.1:22
        post-up iptables -A FORWARD -p tcp -d 10.0.101.1 --dport 22 -j ACCEPT
        post-down iptables -t nat -D POSTROUTING -s '10.0.0.0/16' -o eth0 -j MASQUERADE
        post-down iptables -D PREROUTING -t nat -i eth0 -p tcp -dst IPb --dport 22 -j DNAT --to 10.0.101.1:22
        post-down iptables -D FORWARD -p tcp -d 10.0.101.1 --dport 22 -j ACCEPT
</snip>
0

1 Answer 1

0

I tried -dst IPb in the PREROUTING rule, but this practically caused the rule to not get triggered at all (port forwarding stopped). [3]

Turned out this is the correct approach, but: the entry for IPb must include a subnet length. In this case I just used IPb/32 and it worked as it should.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .