Tropical Software Observations

25 November 2011

Posted by Irregular Zero

at 10:35 PM


Labels: , , ,

KVM host with gateway guest using port-forwarding

Using the 3 rules listed here and below, a KVM host can forward all http and ssh traffic to a specified gateway guest VM:

iptables -t nat -I PREROUTING -p tcp --dport 80 -j DNAT --to-destination
iptables -t nat -I PREROUTING -p tcp --dport 22 -j DNAT --to-destination
iptables -I FORWARD -m state -d --state NEW,RELATED,ESTABLISHED -j ACCEPT

To make it permanent, requires one to go through this page and use the following commands:

sudo sh -c "iptables-save -c > /etc/iptables.rules" (after applying the 3 commands above)
sudo vi /etc/network/if-pre-up.d/iptablesload

The /etc/network/if-pre-up.d/iptablesload file will have the following text:

iptables-restore < /etc/iptables.rules
exit 0

The KVM host will now have VM creation as its sole focus. Ensure the host's ssh port have been changed to make it accessible from outside, otherwise it can be accessed from the gateway guest.

All redirection and VM access are transferred to the the gateway guest. The guest will need to install nginx so it can act as a http proxy for other VMs. All ssh access use the gateway guest as a stepping stone to the other VMs.

Following the 3 rules, it is found the traffic essentially loops back to the gateway guest. This makes it incapable of reaching the other VMs. Applying 1 more rule after the 3 above solves this. The rule accepts all packets from the VM ip range and does not do any forwarding:

iptables -t nat -I PREROUTING -p tcp --source -j ACCEPT


cys0emqjf3 said...

Two propositions on the November 2022 ballot regarding authorized on-line sports betting. Since states are in a position to} make their very own rules regarding sports betting, what you'll be able to|you presumably can} and can't bet on differs relying on where would possibly be}. From which states only permit in-person sports betting to which states don't permit prop bets on college sports, a lot of|there are many} differences you should be|you must be|you should be} aware of. We 메리트카지노 hope our a glance at|have a glance at} the highest on line casino bonus codes helped you resolve which one holds the most effective worth for you.