The private_network is a network that is only between your host and the guest vm. If you want to make the guest vm available to others systems on the same network as your host you need to use the "public_network" setup in vagrant. This will allow your guest to get/use an IP address on the network that your host is on.
config.vm.network "public_network"
http://docs.vagrantup.com/v2/networking/public_network.html
Easiest solution for the SSH access with MASQUERADE setup is to add a port forwarding rule on 2.2.2.2
:
iptables -t nat -I PREROUTING -i eth0 -p tcp --dport 222 -j DNAT --to-destination 1.1.1.1:22
Then you can use ssh -p 222 user@2.2.2.2
to connect to 1.1.1.1
.
If this solution is not enough, then you need a more complex setup.
The MASQUERADE solution above breaks inbound SSH connectivity because of the default route change at 1.1.1.1
.
In this setup incoming packets for the SSH connection come from Internet facing interface. However, 1.1.1.1
sends response packets via 2.2.2.2
, which drops them since they are not associated with a connection.
To work around this, you need to mark the packets belonging to the SSH connection:
iptables -t mangle -A PREROUTING -i eth0 -p tcp --dport 22 -j MARK --set-mark 1
iptables -t mangle -A PREROUTING -m connmark --mark 1 -j CONNMARK --restore-mark
iptables -t mangle -A POSTROUTING -m mark --mark 1 -j CONNMARK --save-mark
First rule applies packet mark 1 to all packets that are destined to SSH port.
Second rule restores existing connection marks to packet marks to handle routing for both directions.
Third rule saves existing packet mark to connection mark for later connection packets.
Next step is to create a custom routing table for packets related to SSH connections:
Edit /etc/iproute2/rt_tables
and add the following line:
100 ssh
Next, add a custom routing table:
sudo ip rule add priority 1000 fwmark 0x1 table ssh
Then, add a route to the custom routing table:
sudo ip route add table ssh 0.0.0.0/0 via <original default route> dev eth0 src 1.1.1.1
Best Answer
Ok, after a small chat with Yahia Zakaria I managed to pinpoint the problem. The app uses more than TCP to communicate, so the proper DNAT should look:
iptables -t nat -A OUTPUT -d 192.168.1.15 -j DNAT --to-destination 54.3.22.1
And that's basically it.