2

I have the iptables rules below forwarding incoming ssh traffic on port 2222 to a virtual machine running in a vmware "vmnet" network on the same host.

192.168.1.1   192.168.1.40
+---------+     +------+     +-----------------+ 
| network |---->| host |__   | virtual machine |
+---------+     +------+ \\__+-----------------+
              192.168.2.1 \_____192.168.2.22  

In the auth.log of the virtual machine, the incoming IP address for remote logins is always the IP of the host that forwarded the packets. How can I preserve the remote IP information?

*filter
:INPUT ACCEPT [593178:45807398]
:FORWARD ACCEPT [881:158378]
:OUTPUT ACCEPT [859348:1232593358]
-A FORWARD -d 192.168.2.22/32 -o vmnet99 -p tcp -m tcp --dport 22 -j ACCEPT
COMMIT

*nat
:PREROUTING ACCEPT [943:138565]
:INPUT ACCEPT [658:122878]
:OUTPUT ACCEPT [3266:229178]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -p tcp -m tcp --dport 2222 -j DNAT --to-destination 192.168.2.22:22
-A POSTROUTING -j MASQUERADE
COMMIT

1 Answer 1

4

Your last iptables rule,

 -A POSTROUTING -j MASQUERADE

is masquerading all packets leaving the host, including those to the VM: this is the reason why you see, on the guest, all packets as coming from the host. You should instead limit masquerading to packets leaving the host for the internet, something like

 -A POSTROUTING -o eth0 -j MASQUERADE

if you call eth0 the interface connected to the Internet.

Edit:

If the question is what else do I need to make IP forwarding work, then a sufficient answer is:

  sudo iptables -t nat -A PREROUTING -p tcp --dport 2222 -j DNAT --to-destination 192.168.2.22:22
5
  • I've been searching around, and I wonder if I need this too. Should I be adding these rules also? -A POSTROUTING -o vmnet99 -j SNAT --to-source 192.168.1.40
    – RaWkStAr
    Dec 19, 2013 at 16:53
  • I see your edits and thank you for your answer. Could you let me know why the SNAT is necessary though? I just happened to come across that rule-type during my research and I wondered if it was needed. Now I see it in your answer and I am wondering what purpose it serves? Thanks.
    – RaWkStAr
    Dec 19, 2013 at 17:48
  • I don't have enough reputation to upvote your answer Marius, but I offer you my gratitude. Thanks for taking the time to help. Good answer!
    – RaWkStAr
    Dec 19, 2013 at 18:47
  • @linuxrawkstar The reason why you do not need the rule with SNAT is that you already have the MASQUERADE rule. They perform the same action (to masquerade the source IP of each packet) but MASQUERADE checks the router (in your case, your pc) IP address every time, while SNAT is used when you already know that you want the packet to come from a given IP address. In other words: if your pc address changes every time, use MASQUERADE; if it has a static IP, you may use SNAT which is faster. Dec 19, 2013 at 19:41
  • Worked for me, i am forwarding ports to my openvpn client, and i was always seeing the sourceip as my openvpn server ip. this fixed the issue
    – Sudhir N
    Nov 25, 2016 at 13:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .