Setting Port Forwarding for Guest VM using iptables: A Proof of Concept

Prerequisites

• A running guest VM using libvirt
• Iptables installed on the host machine

Introduction to Port Forwarding

Port forwarding is the process of redirecting a communication request from one address and port number combination to another while the packets are in transit across a traffic routing device. In the context of virtual machines, port forwarding is used to redirect traffic from a specific port on the host machine to a specific port on the guest VM.

Introduction to iptables

Iptables is a user-space utility program that allows a system administrator to configure the IP packet filter rules of the Linux kernel firewall, implemented as different Netfilter modules. The filters are organized in different tables, which contain chains of rules for how to treat network traffic packets.

Setting up Port Forwarding using iptables

To set up port forwarding using iptables, we need to perform the following steps:

1. Identify the network interface name of the guest VM. This can be done by running the command virsh domiflist <guest-vm-name>.
2. Allow traffic to flow through the interface by adding a rule to the INPUT chain of the filter table. This can be done by running the command sudo iptables -A INPUT -i <interface-name> -j ACCEPT.
3. Add a rule to the PREROUTING chain of the nat table to redirect traffic from the host machine's port to the guest VM's port. This can be done by running the command sudo iptables -t nat -A PREROUTING -p tcp --dport <host-port> -j DNAT --to-destination <guest-ip>:<guest-port>.
4. Add a rule to the POSTROUTING chain of the nat table to enable masquerading. This can be done by running the command sudo iptables -t nat -A POSTROUTING -o <interface-name> -j MASQUERADE.

Example

Let's say we want to forward traffic from port 500 on the host machine to port 80 on the guest VM. The following commands would achieve this:

$ virsh domiflist myguestvm
 Name   State    MAC Address     Bridge Name
--------------------------------------------------
 vnet0  active   52:54:00:12:34:56 virbr0

$ sudo iptables -A INPUT -i vnet0 -j ACCEPT
$ sudo iptables -t nat -A PREROUTING -p tcp --dport 500 -j DNAT --to-destination 192.168.122.2:80
$ sudo iptables -t nat -A POSTROUTING -o vnet0 -j MASQUERADE

In this article, we have covered the process of setting up port forwarding for a guest virtual machine (VM) using iptables as a proof of concept. We have discussed the key concepts related to port forwarding and iptables, and provided a detailed step-by-step guide on how to set up port forwarding. The example provided demonstrates how to forward traffic from port 500 on the host machine to port 80 on the guest VM.

References

• Libvirt
• Virsh
• Iptables
• Netfilter

This article includes references to the following types of resources:

• Online resources