Subject: Re: [vserver] iptables rules for lo interface in guest
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Wed, 30 Sep 2009 13:32:04 +0200

On Wed, Sep 30, 2009 at 09:46:53AM +1300, Michael wrote:
> >> when migrated to virtual server use rules on host to redirect port:
> >> -A PREROUTING -d $EXTIP/32 -i eth0 -p tcp -m tcp --dport 5631 -j DNAT
> >> --to-destination $GEUSTIP:5666

> > you are now trying to DNAT? an outgoing (routed)
> >request to a different port on a potential local?
> >IP ... doesn't really make sense to me ...
> since many guests running and rules needed only for 1guest.

> >> which working OK for any outside access but not for localhost in
> >> guest. so I am a bit confuse how properly apply iptabels on host so
> >> it will work for lo in guest?

> > I doubt, remapping affected the 'localhost' in
> > your Xen setup ....

> there are no more xen installed :) only vserver

> I'm trying to redirect all request (internal for guest-localhost and
> external) for port 5631 to port 5666 for guest_no_1 and not for any
> others.

assuming you guest has the lback address 127.x.y.1,
and the external IP a.b.c.d, the following should
work with a recent kernel/patch:

 # redirect localhost traffic from 5631 to 5666
 iptables -t nat -A OUTPUT -d 127.x.y.1 -p tcp --dport 5631 -j DNAT --to 127.x.y.1:5666

 # redirect external traffic from 5631 to 5666
 iptables -t nat -A PREROUTING -d a.b.c.d -p tcp --dport 5631 -j DNAT --to a.b.c.d:5666

HTH,
Herbert

if you or your company use and like the Linux-VServer project, 
why not consider donating hardware or money, or getting a
service contract with the developers to ensure that it will
live on and continue to provide high quality free software?

> -- 
> --
> Michael