My setup is made of (on the same host):

  • a Network Interface Card (NIC) eth0 with static IP
  • a label to the NIC eth0:0 with static IP
  • a virtual guest machine (using KVM) at on virbr0

I can SSH the guest machine from the host using its IP, and I can SSH the host machine from a remote machine on the LAN network using its IP

I would like to make the virtual guest accessible from the LAN through the labelled NIC so that I can SSH into by connecting to from a remote machine.

| Machine Ext2 |
       | ssh to
   | Router |
       | (
| Machine Ext1 (Host)                          |
| <--> iptables <--> Guest ( |

I got inspired by many things from different tutorials over the web (all look more or less the same) but nothing works and I can't figure out the proper setup..

The idea is to create PREROUTING, FORWARD, and POSTROUTING rules with iptables so that incoming and outgoing traffics are redirected rightfully.

I edited /etc/sysctl.conf so that ip_fordward=1 and ran the following iptables commands:

$ sudo iptables -t nat -A PREROUTING -i virbr0 -p tcp -d --dport 2222 -j DNAT --to-destination
$ sudo iptables -A FORWARD -p tcp -d --dport 22 -j ACCEPT
$ sudo iptables -t nat -A POSTROUTING -o virbr0 -p tcp -d -j ACCEPT

Pinging still work ok. But connecting to fails:

$ telnet 2222
$ telnet: Unable to connect to remote host: Connection refused

I feel like I'm close to get it work but miss out on something.. Can you give me a little help?

Best regards,

  • Welcome to Super User.  It would appear that you have accidentally created two accounts.  You should use the contact form and select “I need to merge user profiles” to have your accounts merged.  In order to merge them, you will need to provide links to the two accounts.  For your information, these are superuser.com/users/655403/jib and superuser.com/users/658828/jib.  You’ll then be able to edit, comment on, and accept answers to this question. – Scott Nov 1 '16 at 18:48
  • Your 1st rule is using -i virbr0 . If it's supposed to be used from LAN, that should be -i eth0 and is most likely your problem.
  • If your default FORWARD policy is ACCEPT, your 2nd rule is useless. If it's DROP then you need an other rule in FORWARD to allow the reverse path flow. Can you give your complete iptables ruleset with: iptables-save -c ?
  • Your 3rd rule is useless. nat tables don't require any explicit ACCEPT. The reverse flow is always made correct (using conntrack) because it's stateful. Remove it.
  • When you test, be sure to do a test from LAN (an other system), not from your host (testing from host itself won't use PREROUTING nor FORWARDING, but nat's OUTPUT and filter's OUTPUT, so that would require at least an other nat rule)

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.