Nat – virtualbox on linux nat configuration

debian-wheezynat;virtualbox

I am trying to set up Network Address Translation on Virtualbox. The host is Debian wheezy and so is the virtualized server.

On virtual server side, no configuration has been made;

On physical server, internet access is through eth0:

    echo 1 > /proc/sys/net/ipv4/ip_forward
    iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

On virtualbox GUI, I have configured my virtual server network to: Adapter 1, Enable Network Adapter, Attached to NAT, cable connected.

on virtual server, no way to ping the gateway (eth0:1), and reciprocally.

This works by setting Bridged Adapter instead of NAT, but is it the normal way to set up NAT in Virtualbox?

Thanks for your help

Best Answer

VirtualBox handles NAT networking internally -- you don't need to configure any iptables rules. Remove your iptables configuration, and then test that the VM has outgoing connectivity. In order to create incoming connections to the VM you'll need to setup port forwarding.

Related Solutions

IPTABLES nat maintaining source IP address with CSF

Question:

We are unsure if with IPTABLES SNAT and/or DNAT it is possible to pass the "real" source IP to the destination.

Answer:

Yes, it is possible, and here's how to do it if you're using CSF. Don't rely on CSF's redirect feature, i.e. having a line similar to the following in /etc/csf/csf.redirect:

XXX.XXX.XXX.184|2222|10.0.0.100|22|tcp

Instead, put the following iptables commands in /etc/csf/csfpost.sh:

/sbin/iptables -I FORWARD -i vmbr0 -o vmbr10 -d 10.0.0.0/24 -j ACCEPT
/sbin/iptables -I FORWARD -i vmbr0 -o vmbr10 -d 10.0.0.0/24 -j LOCALINPUT
/sbin/iptables -t nat -A PREROUTING -i vmbr0 -p tcp -m tcp --dport 2222 -j DNAT --to-destination 10.0.0.100:22

Test:

$ ssh xxx.xxx.xxx.184 -p 2222 'netstat -tn'
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0     72 10.0.0.100:22           xxx.xxx.xxx.199:55812   ESTABLISHED

Explanation:

/sbin/iptables --table nat --append PREROUTING --in-interface vmbr0 --protocol tcp --match tcp --dport 2222 --jump DNAT --to-destination 10.0.0.100:22

This line redirects TCP traffic coming in on the external interface on port 2222 to the internal address 10.0.0.100 on port 22.

/sbin/iptables the full iptables executable is required.
--table nat working on the nat (Network Address Translation) table.
--append PREROUTING append this rule after all existing rules in the PREROUTING chain.
--in-interface vmbr0 catch all traffic comin in on the vmbr0 interface.
--protocol tcp catch only tcp traffic.
--match tcp use the tcp module.
--dport 2222 catch only traffic directed to port 2222.
--jump DNAT perform a Destination Network Address Translation.
--to-destination 10.0.0.100:22 change the destination address to 10.0.0.100 and the destination port to 22.

/sbin/iptables --insert FORWARD --in-interface vmbr0 --out-interface vmbr10 --destination 10.0.0.0/24 --jump LOCALINPUT

This line allows to not skip all of CSF's filtering just because we are redirecting.

/sbin/iptables the full iptables executable is required.
--insert FORWARD insert this rule before existing rules in the FORWARD chain. This is where redirected packets are going, as opposed e.g. to the INPUT chain.
--in-interface vmbr0 match traffic coming in on the vmbr0 interface.
--out-interface vmbr10 match traffic going out from the vmbr0 interface as an effect of redirection.
--destination 10.0.0.0/24 match only traffic destined to (redirected to) the internal network.
--jump LOCALINPUT go through the LOCALINPUT chain. This is where CSF performs all the good filtering it is known for, keeping banned and blacklisted IPs from reaching the system. With this rule, we extend CSF's filtering to all hosts on the internal network (as opposed to just traffic destined for the host where CSF is running).

/sbin/iptables --insert FORWARD --in-interface vmbr0 --out-interface vmbr10 --destination 10.0.0.0/24 --jump ACCEPT

This line passes all remaining forwarded traffic to the internal hosts.

/sbin/iptables the full iptables executable is required.
--insert FORWARD insert this rule before existing rules in the FORWARD chain. This rule will be evaluated after all the filering is performed in the LOCALINPUT chain.
--in-interface vmbr0 match traffic coming in on the vmbr0 interface.
--out-interface vmbr10 match traffic going out from the vmbr0 interface as an effect of redirection.
--destination 10.0.0.0/24 match only traffic destined to (redirected to) the internal network.
--jump ACCEPT after CSF has performed all its filtering (in the LOCALINPUT chain), we want remaining packets to be ACCEPTed.

Best Answer

Related Solutions

IPTABLES nat maintaining source IP address with CSF

Related Topic