Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a small problem with getting a proper configuration of iptables under Ubuntu. But before, let me describe the network configuration:

I am using xDSL line terminated with modem+router+DHCP serving subnet. My laptop and PC are connected to this network and get addresses and respectively. On PC, I have Ubuntu running with VBox and 2 virtual machines (both Ubuntu as well). The vboxnet0 interface on PC is assigned IP and individual virtual machines get and VM1 runs Apache webserver for test purposes.

Now, from my PC (, I can access VM1 Apache hosted website at by typing the address in the browser. No problems there.

However, I would like to be able to access the same website from my laptop (, by typing the same in the address bar in the browser. This does not work, though. I cannot get through the network for some reason. It seems that the ip address is just unknown on the 192.168.1.x network. If there is a way to configure that in a simple manner via iptables, it would be a great start.

Now, if that step is possible, I would further like to be able to configure a more complex setup. Using address and proper port address, I would like to be able to forward specific service requests to proper VM instance. For example, should go to VM1 and fetch the Apache hosted website. (for example), should go to VM2 and get the SFTP service hosted there. In short, I would like to perform destination port specific routing on the PC to allow for bidirectional communication between computers connected to 192.168.1.x networks and VMs running in 10.10.10.x network. Is there a simple solution for this using iptables?

here is an example that I have cooked up by now, but have not been able to make the forwarding work correctly. I am sure there are tons of errors here - it is my first day spent on iptables.

# cleaning Firewall Rules , change ACCEPT to DROP if you want to shield
# the server, then you open ports as you need
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT

# Accepts all established inbound connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# opening INPUT ports (22,80,8080)
iptables -A INPUT --protocol tcp --dport 22 -j ACCEPT && echo "rule input 22 ok"
iptables -A INPUT --protocol tcp --dport 80 -j ACCEPT && echo "rule input 80 ok"
iptables -A INPUT --protocol tcp --dport 443 -j ACCEPT && echo "rule input 443 ok"
iptables -A INPUT --protocol tcp --dport 8080 -j ACCEPT && echo "rule input 8080 ok"

#allow Loopback and networks
iptables -A INPUT -i lo -j ACCEPT  && echo "rule 7 ok"
#Accept any input from network in vboxnet0 interface
iptables -A INPUT -s  -i vboxnet0 -j ACCEPT  && echo "rule 8 ok"

#enable Port forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# Opening PREROUTING - Filtering : this make the port forwarding trick.
# Forward as many ports you want to certain machines of the network to provide services such web server, ftp server, etc...
iptables -t nat -A PREROUTING -p tcp -i eth1 -d --dport 8080 -j DNAT --to  && echo "rule 9 ok"
#iptables -t nat -A PREROUTING -p tcp -i eth1 -d --dport 53 -j DNAT --to  && echo "rule 10 ok"
#iptables -t nat -A PREROUTING -p udp -i eth1 -d --dport 53 -j DNAT --to  && echo "rule 11 ok"
#iptables -t nat -A PREROUTING -p udp -i eth1 -d --dport 21 -j DNAT --to  && echo "rule 12 ok"

#Opening FORWARD ports for network services on vlan
iptables -A FORWARD -s -i vboxnet0 -p tcp --dport 80 -j ACCEPT && echo "rule 13 ok"
#iptables -A FORWARD -s -i vboxnet0 -p tcp --dport 21 -j ACCEPT  && echo "rule 14 ok"
#iptables -A FORWARD -s -i vboxnet0 -p tcp --dport 68 -j ACCEPT  && echo "rule 15 ok"
#iptables -A FORWARD -s -i vboxnet0 -p tcp --dport 22 -j ACCEPT  && echo "rule 16 ok"
#iptables -A FORWARD -s -i vboxnet0 -p tcp --dport 53 -j ACCEPT && echo "Rule 17 ok"
#iptables -A FORWARD -s -i vboxnet0 -p udp --dport 53 -j ACCEPT && echo "Rule 18 ok"

# Netmasking is absolutelly necesary to protect vlan from attacks, only it hides their ip....
iptables -t nat -A POSTROUTING -s -o eth1 -j MASQUERADE  && echo "rule 19 ok"

# Reject all other inbound - default deny unless explicitly allowed policy
iptables -A INPUT -j REJECT
iptables -A FORWARD -j REJECT

# test and display the rules if runs properly
iptables -L

Thank you for any help


share|improve this question

Firstly, you should consider the simpler setup of using bridged networking in VirtualBox. This will essentially put the VMs directly on the LAN, so they will get addresses and can be accessed directly from other machines on the LAN.

Your DNAT rule looks correct, but I suspect that it's being blocked in the FORWARD chain. NATed packets still need to traverse the FORWARD chain, and so they need to be accepted there, with something like this:

iptables --append FORWARD --in-interface eth1 --out-interface vboxnet0 --destination --protocol tcp --dport 80 --jump ACCEPT

However, I would suggest that you configure the FORWARD chain to ACCEPT by default while you are getting the NAT rules working. Once the NAT is working, then start restricting the FORWARD chain.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .