QEMU guest can access HTTPS sites, but not HTTP

Question

So I'm configuring a QEMU guest on my Debian Wheezy server, using virt-manager.

As guest I've installed Ubuntu 14.04.1 server.

The server contains the following iptables rule:

iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 3080
iptables -t nat -I OUTPUT -p tcp -d 127.0.0.1 --dport 80 -j REDIRECT --to-ports 3080

This was taken from the serverfault question "How to run a server on port 80 as a normal user on Linux?"

So incoming HTTP requests on port 80 to the Debian host are being redirected to the correct application.

But, as a side effect, outgoing requests from my QEMU guest are also being redirected there. How can I fix that?

What sort of server is this? What about the network it's on? Any firewalls, etc? — Michael Hampton, Sep 22 '14 at 12:21
It's basically a clean Debian server install with no firewall. — Jelle De Loecker, Sep 22 '14 at 12:27
as I see **http: //www.google.be/** redirects to **https ://www.google.be/** that is the reason it is not able to wget the URL try some url like **http:// serverfault.com/** and see if that helps. — Pratap, Sep 22 '14 at 13:20
I've found the culprit: an iptables rule, I'll update the question — Jelle De Loecker, Sep 22 '14 at 13:33
Well, I'll refer to the 'basically' in my statement in order to save some face :) — Jelle De Loecker, Sep 22 '14 at 13:45

score 0 · Answer 1 · answered Sep 23 '14 at 08:43

The rule

iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 3080

means redirect everything with destination port 80 to port 3080 and that matches all the HTTP traffic. You'll need to put an IP address or an interface in order to be specific: if your IP address is 1.2.3.4, this will do:

iptables -t nat -A PREROUTING -d 1.2.3.4 -p tcp --dport 80 -j REDIRECT --to-port 3080

The -d 1.2.3.4 flag specifies destination address and only requests to your IP will be redirected.

Another option is to use the network interface, so if your internet connection is on eth0, you can use:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3080

Which also would work because -i matches incoming traffic on the eth0 interface, e.g. requests made to your computer.

You can even combine the filters (e.g. you have multiple NICs and multiple IPs, but you want to run the site only on a single pair)

iptables -t nat -A PREROUTING -i eth0 -d 1.2.3.4 -p tcp -j REDIRECT --to-port 3080

You should consult the iptables manual if you need fine control over who gets redirected, gets blocked, etc.

QEMU guest can access HTTPS sites, but not HTTP

1 Answers1