On Wed, Sep 30, 2009 at 09:46:53AM +1300, Michael wrote: > >> when migrated to virtual server use rules on host to redirect port: > >> -A PREROUTING -d $EXTIP/32 -i eth0 -p tcp -m tcp --dport 5631 -j DNAT > >> --to-destination $GEUSTIP:5666 > > you are now trying to DNAT? an outgoing (routed) > >request to a different port on a potential local? > >IP ... doesn't really make sense to me ... > since many guests running and rules needed only for 1guest. > >> which working OK for any outside access but not for localhost in > >> guest. so I am a bit confuse how properly apply iptabels on host so > >> it will work for lo in guest? > > I doubt, remapping affected the 'localhost' in > > your Xen setup .... > there are no more xen installed :) only vserver > I'm trying to redirect all request (internal for guest-localhost and > external) for port 5631 to port 5666 for guest_no_1 and not for any > others. assuming you guest has the lback address 127.x.y.1, and the external IP a.b.c.d, the following should work with a recent kernel/patch: # redirect localhost traffic from 5631 to 5666 iptables -t nat -A OUTPUT -d 127.x.y.1 -p tcp --dport 5631 -j DNAT --to 127.x.y.1:5666 # redirect external traffic from 5631 to 5666 iptables -t nat -A PREROUTING -d a.b.c.d -p tcp --dport 5631 -j DNAT --to a.b.c.d:5666 HTH, Herbert if you or your company use and like the Linux-VServer project, why not consider donating hardware or money, or getting a service contract with the developers to ensure that it will live on and continue to provide high quality free software? > -- > -- > Michael