Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I can rdesktop into a VM running Windows XP hosted on my CentOS 5.4 machine from the hosting machine and work just fine using the private address (, but I now need to allow remote desktop access from other computers (not just the machine hosting the VM).

I only need to allow access for a day or so, so don't want to add a NIC (for XP activation reasons).

Could someone help me with the iptables syntax?

The VM is on a private/virtual network: and my CentOS machine is on a physical network, at (and as the GW for the virtual net).

I found a question on iptables rules to forward a Windows remote desktop connection, but none of the answers seemed to work and I'm a bit timid at blindly trying variations. My FORWARD rules are as listed.

# iptables -L FORWARD
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere       state RELATED,ESTABLISHED 
ACCEPT     all  --     anywhere            
ACCEPT     all  --  anywhere             anywhere            
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 
RH-Firewall-1-INPUT  all  --  anywhere             anywhere

If I do play "blindly" is there a simple way to reset the settings on CentOS (a la service network restart)?

share|improve this question
I want to leave the working system as-is, and provide remote access to the VM for a single day. I initially pondered putting the VM on the external subnet, but except for this short-term need, it ain't broken. And having it on the virtual network removes the need for any firewall on WXP. – NVRAM Mar 5 '10 at 6:52

Before you do anything, do a service iptables save. That copies all your iptables rules to /etc/sysconfig/iptables. From here you can copy that file out and then test to your heart's content. To restore to that ruleset that you saved, make sure the ruleset is in the same file(if you didn't save any other iptables then you should be good) and do a service iptables resart. The ruleset that you had when you saved is now back in place.

Update now that I have time: Syntax I believe will work: iptables -t nat -A PREROUTING -p tcp --dport 3389 --to-destination ; echo 1 > /proc/sys/net/ipv4/ip_forward. Note that this means that any RDP traffic coming into this host will be forwarded.

share|improve this answer

It should work just fine with the example in the post you linked to. Has to be done in the nat table of iptables, like this:

iptables -t nat -I PREROUTING -p tcp -d --dport 3389 -j DNAT --to-destination

Then REMOTELY connect to port 3389 with your RDP client.

share|improve this answer

I would rather bridge the network card on the VM with the one on the host, so that the VM gets an IP address in the 10.1.3.X range from the DHCP server serving the host (or, if you are using static IP addresses, set your own).

Whether this is acceptable depends on your situation, but if you were using a separate physical machine rather than a VM, if you would just stick that onto your network, then do the same with your VM.

share|improve this answer
To expand on this answer, your VM manager should give you a few different options for the type of network connection the virtual NIC will be using. It's common for the adapter to be configured in NAT (network address translation) mode. This essentially places the VM on another subnet from the host, as if it is behind a virtual router. You should be able to configure the NIC for bridged mode, which causes the VM to share the host's NIC on the same subnet as the host. This will make the VM visible to all on that subnet without the need for additional routing. – Joe Internet Mar 5 '10 at 2:40
Thanks for clarifying but I knew this (I was a heavy VMWare user 5-10 years ago). However, I didn't want to alter the VM and that's why I asked specifically for iptables syntax. – NVRAM Mar 9 '10 at 17:28
As I said, it depends on your situation, and it is easier to just bridge the network card... Anyway, explains how to do this with iptables (as well as by using Virtualbox built in stuff), so it may help you. – Neal Mar 9 '10 at 22:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.