Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to redirect a certain port range in a linux host to one of its guest VMs. I would like for this redirection to apply to all the host's interfaces, including localhost. I was able to do:

iptables -I FORWARD -m state -d --state NEW,RELATED,ESTABLISHED -j ACCEPT
iptables -t nat -I PREROUTING -p tcp --dport 8000:8500 -j DNAT --to

Where 8000:8500 is the range I am interested in forwarding and is the guest's IP. This works as long as I am trying to connect from another machine, i.e. not the VM host. But I would also like to be able to forward traffic that originates inside the VM host.

Hope that is clear, sorry if I mangled the terminology.

share|improve this question

migrated from May 11 '13 at 1:41

This question came from our site for professional and enthusiast programmers.

up vote 1 down vote accepted

Apparently performing DNAT for loopback traffic is not possible — e.g., see this question, or this debian-user discussion. Using REDIRECT works because traffic stays on the loopback interface, but forwarding the traffic to another machine does not work.

You could use a userspace program to forward TCP connections — e.g., xinetd with the following configuration will forward port 8000 to your VM:

service forward_8000
        type                    = UNLISTED
        port                    = 8000
        socket_type             = stream
        wait                    = no
        user                    = root
        redirect                = 8000

However, it is not possible to redirect a range of ports this way — every port needs a separate service definition.

share|improve this answer
Thank you. I found rinetd which is slightly easier to setup than xinetd for this amount of ports. I am awarding you the bounty since you provided as close to an authoritative answer as I am likely to get. take care. – samwise May 15 '13 at 19:44

Local packets will not enter the PREROUTING chain. I believe you will need to use the OUTPUT chain in the NAT table to do that:

iptables -t nat -I OUTPUT -p tcp --dport 8000:8500 -j DNAT --to

You will possibly also need to add a rule to the filter chain that allows these outbound and their related packets:

iptables -I OUTPUT -m state -d --state NEW,RELATED,ESTABLISHED -j ACCEPT
share|improve this answer
That does not seem to work. I get the same result, i.e., telnet localhost 8000 is unable to connect (I have something running on VM on port 8000) – samwise May 10 '13 at 22:45
You may also need to add a rule to allow the packets out. (The counterpart of your FORWARD rule.) I recommend you check your packets with tcpdump so you see what's actually happening. – Janoszen May 10 '13 at 22:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .