2

Situation: I have a dedicated Server (CentOS 6) with couple of VMs(Cent OS 7 and Windows Server 2012 R2) in Virtual Box. Few applications are running in windows and reachable from the Main IP(X.X.105.20) Using mod proxy. The Application hosted in Linux VM requires to be reachable from different IP(X.X.109.118)(The second IP address of server).

What have I Tried: So far I tried with IP forwarding from this SF question but the Application is not reachable.

iptables -t nat -A PREROUTING -p tcp -d X.X.109.118 -j DNAT --to-destination 192.168.56.102
iptables -t nat -A POSTROUTING -p tcp -d 192.168.56.102 -j SNAT --to-source X.X.109.118


iptables -I FORWARD -m state -d 192.168.56.102 --state NEW,RELATED,ESTABLISHED -j ACCEPT

BTW, The application is reachable from windows Guest as well as from CentOS Host

Edit Based on The comment: I have two domains. A few .net based Web Applications are running in windows server using sub-domains of one of the domains. And I'm using another domain name for the application running in Linux. So its all name based access for first domain(and its sub-domains) which is also using the main IP address. The Second Domain I have registered to the additional IP address X.X.1.118. The ping is fine as well( using both IP and Domain Name). All I want is this IP Could send (and Receive) all the communication to the VM at 192.168.56.102.

Community
  • 1
Anup Sharma
  • 77

1 Answers1

2

Your second rule are matching 192.168.56.102 as destination, but the POSTROUTING chain need to be used for rewrite the destination of packets coming (--source) from 192.168.56.102 (the response).

Change your second rule to:

iptables -t nat -A POSTROUTING -p tcp -s 192.168.56.102 -j SNAT --to-source X.X.109.118

or 

iptables -t nat -A POSTROUTING -p tcp -s 192.168.56.102 -j MASQUERADE

You are sending all the tcp packets with destination X.X.109.118 to the linux VM, so you can't have any web server listening on this address on the dedicated host.

Make sure apache is not listening on the IP address you are forwarding to avoid packets be processed by the INPUT chain.

Or you can have a name based virtual host configured for the domain but only listening on the address (just this virtualhost listening on X.X.109.118) and remove the iptables rules.

i.e: 

<Virtualhost X.X.109.118:443>
[...]
</Virtualhost>
fgbreel
  • 683
  • 4
  • 13