2
I have a Debian 7 server with 5 public IP addresses. On the server I have several KVM guests (all Debian 8). One of the guests needs to be publicly accessible using one of the public IPs. This one has IP address 192.168.122.133
and all other guests have IPs in the range 192.168.122.50/28
.
I currently have it set up so that the guests can communicate with each other, however external incoming and outgoing connections fail with the guest that needs to be publicly accessible (only connections from local network work).
These are the rules that I believe are supposed to forward all incoming and outgoing traffic to and from it this guest, but it doesn't seem to be doing what it should:
/sbin/iptables -t nat -I PREROUTING -d 111.111.111.133 -j DNAT --to 192.168.122.133
/sbin/iptables -t nat -I POSTROUTING -s 192.168.122.133 -j SNAT --to 111.111.111.133
/sbin/iptables -t filter -I FORWARD -d 192.168.122.133 -j ACCEPT
/sbin/iptables -t filter -I FORWARD -s 192.168.122.133 -j ACCEPT
Previously I had this set up and I believe at one point in time it was working correctly, but I might have changed something or some sort of system update might have changed something and now it's not working.
More info:
The KVM network is configured:
<network>
<name>default</name>
<uuid>261764e8-ef0c-dc57-90b5-4c356ae12bf1</uuid>
<forward mode='nat'/>
<bridge name='virbr0' stp='on' delay='0' />
<mac address='52:54:00:77:D9:2B'/>
<ip address='192.168.122.1' netmask='255.255.255.0'>
<dhcp>
<range start='192.168.122.2' end='192.168.122.254' />
</dhcp>
</ip>
</network>
And the guest network configurations are like this:
<interface type='network'>
<mac address='52:54:00:61:d9:ba'/>
<source network='default'/>
<model type='virtio'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
</interface>
Here is my /etc/network/interfaces on the host server:
# The loopback network interface
auto lo
auto eth3
auto eth3:0
auto eth3:1
auto eth3:2
auto eth3:3
iface lo inet loopback
# The primary network interface
allow-hotplug eth3
iface eth3 inet static
address 111.111.111.130
netmask 255.255.255.248
network 111.111.111.128
broadcast 111.111.111.135
gateway 111.111.111.129
dns-nameservers 8.8.8.8 8.8.4.4 127.0.0.1
iface eth3:0 inet static
address 111.111.111.131
netmask 255.255.255.248
iface eth3:1 inet static
address 111.111.111.132
netmask 255.255.255.248
iface eth3:2 inet static
address 111.111.111.133
netmask 255.255.255.248
iface eth3:3 inet static
address 111.111.111.134
netmask 255.255.255.248
The guests are set up with static IPs. For example:
iface eth0 inet static
address 192.168.122.133
netmask 255.255.255.0
network 192.168.122.0
broadcast 192.168.122.255
gateway 192.168.122.1
dns-nameservers 192.168.122.1
I believe this is what allows the guests that should not be accessible from the Internet to access the Internet (adapted from here) - note, they are in a slightly different IP range:
/sbin/iptables -t nat -A POSTROUTING -s 192.168.122.50/28 ! -d 192.168.122.50/28 -p tcp -j MASQUERADE --to-ports 1024-65535
/sbin/iptables -t nat -A POSTROUTING -s 192.168.122.50/28 ! -d 192.168.122.50/28 -p udp -j MASQUERADE --to-ports 1024-65535
/sbin/iptables -t nat -A POSTROUTING -s 192.168.122.50/28 ! -d 192.168.122.50/28 -j MASQUERADE
/sbin/iptables -t filter -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -t filter -A FORWARD -s 192.168.122.50/28 -i virbr0 -j ACCEPT
/sbin/iptables -t filter -A INPUT -s 192.168.122.50/28 -i virbr0 -j ACCEPT