iptables syntax to forward remote desktop requests to a virtual machine on CentOS host

Question

I can rdesktop into a VM running Windows XP hosted on my CentOS 5.4 machine from the hosting machine and work just fine using the private address (192.168.122.65), but I now need to allow remote desktop access from other computers (not just the machine hosting the VM).

I only need to allow access for a day or so, so don't want to add a NIC (for XP activation reasons).

Could someone help me with the iptables syntax?

The VM is on a private/virtual network: 192.168.122.65 and my CentOS machine is on a physical network, at 10.1.3.38 (and 192.168.122.1 as the GW for the virtual net).

I found a question on iptables rules to forward a Windows remote desktop connection, but none of the answers seemed to work and I'm a bit timid at blindly trying variations. My FORWARD rules are as listed.

# iptables -L FORWARD
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             192.168.122.0/24    state RELATED,ESTABLISHED 
ACCEPT     all  --  192.168.122.0/24     anywhere            
ACCEPT     all  --  anywhere             anywhere            
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 
RH-Firewall-1-INPUT  all  --  anywhere             anywhere

If I do play "blindly" is there a simple way to reset the settings on CentOS (a la service network restart)?

Answer 1

I would rather bridge the network card on the VM with the one on the host, so that the VM gets an IP address in the 10.1.3.X range from the DHCP server serving the host (or, if you are using static IP addresses, set your own).

Whether this is acceptable depends on your situation, but if you were using a separate physical machine rather than a VM, if you would just stick that onto your network, then do the same with your VM.

Answer 2

Before you do anything, do a service iptables save. That copies all your iptables rules to /etc/sysconfig/iptables. From here you can copy that file out and then test to your heart's content. To restore to that ruleset that you saved, make sure the ruleset is in the same file(if you didn't save any other iptables then you should be good) and do a service iptables resart. The ruleset that you had when you saved is now back in place.

Update now that I have time: Syntax I believe will work: iptables -t nat -A PREROUTING -p tcp --dport 3389 --to-destination 192.168.122.65 ; echo 1 > /proc/sys/net/ipv4/ip_forward. Note that this means that any RDP traffic coming into this host will be forwarded.

Answer 3

It should work just fine with the example in the post you linked to. Has to be done in the nat table of iptables, like this:

iptables -t nat -I PREROUTING -p tcp -d 10.1.3.38 --dport 3389 -j DNAT --to-destination 192.168.122.65

Then REMOTELY connect to 10.1.3.38 port 3389 with your RDP client.