Forward Ports to Private VEs (DNAT)

Use network address translation (DNAT) to forward ports to virtual machines which are connected in a private subnet (e.g. 192.168.1.0/24). The following statement will forward all packets received at the HN eth0 interface on port 443 to the virtual interface with address 192.168.1.123, port 443.



hn# iptables -A PREROUTING -t nat -i eth0 -p tcp -d 12.12.12.12 --dport 443 -j DNAT --to-dest 192.168.1.123:443

Make sure you specified the HN interface address (-d) otherwise request of all VEs will be sent to the specified destination host as well. Use the following command to list iptables NAT rules

hn# iptables -L -n -t nat
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
DNAT tcp -- 0.0.0.0/0 12.12.12.12 tcp dpt:80 to:192.168.1.123:443
...