NAT forwarding (whole IP) working only on some ports

Question

Since my hoster doesn't allow briged setups I had to go for a NAT solution to run my CentOS VM on an additional IP and my host machine on the primary IP.

Now, I've got a problem since for ports 22, 80 and 443 this works as expected. I reach my SSH/Apache under CentOS. But I'm also running a DB2 instance on port 50000, and this one I can't reach. Connection refused each time.

I can however reach the port from the host machine using the internal 192.168.56.2 IP, so there is no firewall blocking my request on the guest system.

This is the setup:

Ubuntu 12.04 host machine:

ifconfig -a
eth0      Link encap:Ethernet  HWaddr censored
      inet addr:85.25.PRIMARY.IP  Bcast:85.25.NETWORK.SEGMENT  Mask:255.255.255.0
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

eth0:1    Link encap:Ethernet  HWaddr censored
      inet addr:85.25.SECONDARY.IP  Bcast:0.0.0.0  Mask:255.255.255.255
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

vboxnet0  Link encap:Ethernet  HWaddr 0a:00:27:00:00:00
      inet addr:192.168.56.1  Bcast:192.168.56.255  Mask:255.255.255.0
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1


iptables -t nat -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-A PREROUTING -d 85.25.SECONDARY.IP/32 -i eth0 -j DNAT --to-destination 192.168.56.2
-A PREROUTING -d 85.25.SECONDARY.IP/32 -i eth0 -j DNAT --to-destination 192.168.56.2
-A POSTROUTING -s 192.168.56.2/32 -o eth0 -j SNAT --to-source 85.25.SECONDARY.IP
-A POSTROUTING -s 192.168.56.2/32 -o eth0 -j SNAT --to-source 85.25.SECONDARY.IP

On the guest machine (CentOS 6.6):

ifconfig -a
eth0      Link encap:Ethernet  HWaddr 08:00:27:D6:D5:4B
          inet addr:192.168.56.2  Bcast:192.168.56.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

eth0:1    Link encap:Ethernet  HWaddr 08:00:27:D6:D5:4B
          inet addr:85.25.SECONDARY.IP  Bcast:85.25.SECONDARY.IP  Mask:255.255.255.255
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1


iptables -t nat -S
-P PREROUTING ACCEPT
-P POSTROUTING ACCEPT
-P OUTPUT ACCEPT

Any ideas?

//edit: IP-forwarding is enabled of course (net.ipv4.ip_forward=1)

score 0 · Answer 1 · answered May 27 '15 at 12:00

Solved. It had nothing to do with my (correct) configuration but with a proxy I use to connect to non-standard ports. Turns out if you are already on the system (via the proxy) you need to open connection directly to the virtual ip because prerouting rules don't apply and your request won't get forwarded automatically.

NAT forwarding (whole IP) working only on some ports

1 Answers1