iptables forward traffic between two interfaces

Question

My setup is made of (on the same host):

• a Network Interface Card (NIC) eth0 with static IP 192.168.1.10
• a label to the NIC eth0:0 with static IP 192.168.1.11
• a virtual guest machine (using KVM) at 192.168.122.11 on virbr0

I can SSH the guest machine from the host using its IP 192.168.122.11, and I can SSH the host machine from a remote machine on the LAN network using its IP 192.168.1.10.

I would like to make the virtual guest accessible from the LAN through the labelled NIC so that I can SSH into 192.168.122.11 by connecting to 192.168.1.11 from a remote machine.

+--------------+
| Machine Ext2 |
+--------------+
       | ssh to 192.168.1.11:2222
       |
   +--------+
   | Router |
   +--------+
       |
       | (192.168.1.11:2222)
+----------------------------------------------+
| Machine Ext1 (Host)                          |
| <--> iptables <--> Guest (192.168.122.11:22) |
+----------------------------------------------+

I got inspired by many things from different tutorials over the web (all look more or less the same) but nothing works and I can't figure out the proper setup..

The idea is to create PREROUTING, FORWARD, and POSTROUTING rules with iptables so that incoming and outgoing traffics are redirected rightfully.

I edited /etc/sysctl.conf so that ip_fordward=1 and ran the following iptables commands:

$ sudo iptables -t nat -A PREROUTING -i virbr0 -p tcp -d 192.168.1.11 --dport 2222 -j DNAT --to-destination 192.168.122.11:22
$ sudo iptables -A FORWARD -p tcp -d 192.168.122.11 --dport 22 -j ACCEPT
$ sudo iptables -t nat -A POSTROUTING -o virbr0 -p tcp -d 192.168.122.11 -j ACCEPT

Pinging 192.168.1.11 still work ok. But connecting to 192.168.1.11:2222 fails:

$ telnet 192.168.1.11 2222
$ telnet: Unable to connect to remote host: Connection refused

I feel like I'm close to get it work but miss out on something.. Can you give me a little help?

Best regards,

Answer 1

• Your 1st rule is using -i virbr0 . If it's supposed to be used from LAN, that should be -i eth0 and is most likely your problem.
• If your default FORWARD policy is ACCEPT, your 2nd rule is useless. If it's DROP then you need an other rule in FORWARD to allow the reverse path flow. Can you give your complete iptables ruleset with: iptables-save -c ?
• Your 3rd rule is useless. nat tables don't require any explicit ACCEPT. The reverse flow is always made correct (using conntrack) because it's stateful. Remove it.
• When you test, be sure to do a test from LAN (an other system), not from your host (testing from host itself won't use PREROUTING nor FORWARDING, but nat's OUTPUT and filter's OUTPUT, so that would require at least an other nat rule)