Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have the iptables rules below forwarding incoming ssh traffic on port 2222 to a virtual machine running in a vmware "vmnet" network on the same host.

192.168.1.1   192.168.1.40
+---------+     +------+     +-----------------+ 
| network |---->| host |__   | virtual machine |
+---------+     +------+ \\__+-----------------+
              192.168.2.1 \_____192.168.2.22  

In the auth.log of the virtual machine, the incoming IP address for remote logins is always the IP of the host that forwarded the packets. How can I preserve the remote IP information?

*filter
:INPUT ACCEPT [593178:45807398]
:FORWARD ACCEPT [881:158378]
:OUTPUT ACCEPT [859348:1232593358]
-A FORWARD -d 192.168.2.22/32 -o vmnet99 -p tcp -m tcp --dport 22 -j ACCEPT
COMMIT

*nat
:PREROUTING ACCEPT [943:138565]
:INPUT ACCEPT [658:122878]
:OUTPUT ACCEPT [3266:229178]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -p tcp -m tcp --dport 2222 -j DNAT --to-destination 192.168.2.22:22
-A POSTROUTING -j MASQUERADE
COMMIT
share|improve this question

1 Answer 1

up vote 2 down vote accepted

Your last iptables rule,

 -A POSTROUTING -j MASQUERADE

is masquerading all packets leaving the host, including those to the VM: this is the reason why you see, on the host, all packets as coming from the host. You should instead limit masquerading to packets leaving the host for the internet, something like

 -A POSTROUTING -o eth0 -j MASQUERADE

if you call eth0 the interface connected to the Internet.

Edit:

If the question is what else do I need to make IP forwarding work, then a sufficient answer is:

  sudo iptables -t nat -A PREROUTING -p tcp --dport 2222 -j DNAT --to-destination 192.168.2.22:22
share|improve this answer
    
I've been searching around, and I wonder if I need this too. Should I be adding these rules also? -A POSTROUTING -o vmnet99 -j SNAT --to-source 192.168.1.40 –  linuxrawkstar Dec 19 '13 at 16:53
    
I see your edits and thank you for your answer. Could you let me know why the SNAT is necessary though? I just happened to come across that rule-type during my research and I wondered if it was needed. Now I see it in your answer and I am wondering what purpose it serves? Thanks. –  linuxrawkstar Dec 19 '13 at 17:48
    
I don't have enough reputation to upvote your answer Marius, but I offer you my gratitude. Thanks for taking the time to help. Good answer! –  linuxrawkstar Dec 19 '13 at 18:47
    
@linuxrawkstar The reason why you do not need the rule with SNAT is that you already have the MASQUERADE rule. They perform the same action (to masquerade the source IP of each packet) but MASQUERADE checks the router (in your case, your pc) IP address every time, while SNAT is used when you already know that you want the packet to come from a given IP address. In other words: if your pc address changes every time, use MASQUERADE; if it has a static IP, you may use SNAT which is faster. –  MariusMatutiae Dec 19 '13 at 19:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.