Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have got a VMware Server 2 on a CentOS 5.6 host. I can access my virtual machines from the host machine, but I can not access it from other machines.

I have configured NAT port forwarding. But somehow I have no access to the VM using ssh. I have checked all firewall settings and they seem right.

What can cause this problem?

share|improve this question
Hi Bilal - someone would need much more detail to answer your question. From what I understand, you have an ESX v2 box w/a Cent 5.6 VM on it? If that is the case, which firewall are you talking about - on the hypervisor (ESX box) or the VM? Where's the other system you're ssh-ing to/from? It sounds like your vSwitch needs some love, but I need more detail. – mjb Jul 8 '11 at 17:00
no i have vmware server 2 on centos 5.6 as i mentioned. I am talking about firewall of host machine. i have ssh access from host to vm, i have ssh access over internet (out of network) to host, but i have no direct access to vm throug ssh. – bilal Jul 8 '11 at 18:53
That makes more sense - thanks for the clarification – mjb Jul 8 '11 at 21:29

There are two separate networks you are dealing with here. I'll give you an example:

IP your ISP gives you =
IP of your router =
Host System IP =
IP of your VM =

This configuration is how my virtual environment's networking looks. So you actually have two networks you would have to port forward across to get Public access to your VM. Think of it like your hypervisor (host system) IS a router for your VM.

I followed this how-to to setup my config, but you may have a more complex configuration.. it depends on what application you want to run - RDC, apache, ssh. There is more good information here. You'll have to give more detail than I would want to ask for on a public site for me to help with specifics. The principles are always the same -- make a localhost:<> connection to your physical system forward through VMware Server 2 to the VM port you want to access (22 for SSH).

share|improve this answer
my configuration is exactly same like your how-to link. i am forwarding an Ip on my host for example: 2222 to 22 of my vm in my nat config. 2222 : – bilal Jul 8 '11 at 21:41
by the way i am getting server unexpectedly closed network connection, if it gives more information – bilal Jul 8 '11 at 22:49
can you ssh on the same subnet? From a host on the same IP range (192.168.2.x in the example above)? – mjb Jul 11 '11 at 19:21

If you are able to ssh into host from remote, than you need to check the firewall on host, if ssh ports (22) are forwarded to vm.

There is a similar question here.

There, it is the ufw firewall, which needs to have a rule like

ufw route allow 2222/tcp to port 22

to allow connection to host on port 2222 and forward tcp to vm guest at ip

And this User mentioned, that ufw is a frontend to iptables, so go to your frontend or edit your iptables in that kind.

iptables -t nat -A PREROUTING -m tcp -p tcp --dport 2222 -j DNAT --to-destination

The missing part

Short version You told iptables to add a PREROUTING rule to your nat table. The missing part is:

# After DNAT, the packets are routed via the filter table's
# FORWARD chain.
# Connections on port 22 to the target machine on the private
# network must be allowed.
# The `\` masks the `linebreak` in the `bash command`
# You can `copy & paste` all the lines at once

# From the manual
# Changing to specific IP and Interfaces  
# being:
# `eth0` your host adapter and
# `vmnet8` your guest adapter

This is the connection into the target machine:

iptables -A FORWARD -p tcp -i eth0 -o vmnet8 -d \
    --dport 22 --sport 2222 -m state --state NEW -j ACCEPT

And these are the filter from host interface to your guest interface and vice versa.

iptables -A FORWARD -t filter -o eth0 -m state \

iptables -A FORWARD -t filter -i vmnet8 -m state \
share|improve this answer

Does your host have a virtual NIC in the NAT network?

When using VMware Workstation 9 on Win7, you need to open the network manager and tick the box "Connect a host virtual adapter to this network" before your Host is connected to the NAT network. There's probably a similar process for Linux.

This is intentional, and allows the creation of a secure virtual network that has no "no route to host" to the Hypervisor.

share|improve this answer

on the centOS 5.6 host service iptables stop Under most circumstances backend hosts do not need iptables running and this could / will block your connections.

Are you forwarding ALL the ports? 80/443/902/903/

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .