Opening the ports of a Xen domU using NAT
When Xen is setted up with a NAT network, iptables is needed to associate domU's ports to dom0 ones. This howto helps you to configure the needed iptables' rules.
This howto is tested on :
- Debian 5.0 Lenny
- Debian 6.0 Squeeze
- Debian 7.0 Wheezy
Parameters
Provide the IP address of the domU which ports are to be opened :
DOMU_IP="10.0.0.1"
Provide the domU's port number to open :
DOMU_PORT=80
Note : you can provide a port range :
# DOMU_PORT=49160-49299
Provide the network interface to which bind the domU's port (optionnal, eth0 is used by default) :
# DOM0_NET="eth0"
Provide the protocol (optionnal, by default tcp) :
# DOMU_PROTO="udp"
Installation
Prerequisites
Create the iptables rules file. The rules presents in this file are applied at network interfaces startup :
if [ ! -e '/etc/network/if-up.d/iptables' ]; then command echo '#!/bin/sh # IpTables rules. # Purging prerouting rules before reloading them iptables -t nat -F PREROUTING' \
> '/etc/network/if-up.d/iptables' fi command chmod +x '/etc/network/if-up.d/iptables'
Allow iptables to use NAT :
command sed -i -e 's/[# ]*\(net\.ipv4\.conf\.default\.forwarding=\).*/\11/g' \ -e 's/[# ]*\(net\.ipv4\.ip_forward=\).*/\11/g' \ '/etc/sysctl.conf' command sysctl -p
Setup
Detectez the IP address IP of the binded network interface :
test -z "${DOM0_NET}" && DOM0_NET="eth0"
DOM0_IP=$(command ifconfig ${DOM0_NET} \
| command grep "inet adr" \
| command sed -e 's/.*inet adr:\([^ ]*\) .*/\1/')
Detect the protocol :
test -z "${DOMU_PROTO}" && DOMU_PROTO="tcp"
Load the new NAT rule :
command iptables -C PREROUTING -t nat \
-p ${DOMU_PROTO} -d ${DOM0_IP} --dport $(echo ${DOMU_PORT} | command tr '-' ':') \
-j DNAT --to ${DOMU_IP}:${DOMU_PORT} 2>'/dev/null' \
|| command iptables -A PREROUTING -t nat \
-p ${DOMU_PROTO} -d ${DOM0_IP} --dport $(echo ${DOMU_PORT} | command tr '-' ':') \
-j DNAT --to ${DOMU_IP}:${DOMU_PORT}
Add the NAT rule to the permanent iptables configuration :
CLEAN_DOMU_PORT=$(echo ${DOMU_PORT} | command tr '-' ':')
echo " # Opening port ${DOMU_PORT} from ${DOM0_IP} to IP address ${DOMU_IP} :
command iptables -C PREROUTING -t nat -p ${DOMU_PROTO} \\
-d ${DOM0_IP} --dport ${CLEAN_DOMU_PORT} \\
-j DNAT --to ${DOMU_IP}:${DOMU_PORT} 2>'/dev/null' \\
|| command iptables -A PREROUTING -t nat -p ${DOMU_PROTO} \\
-d ${DOM0_IP} --dport ${CLEAN_DOMU_PORT} \\
-j DNAT --to ${DOMU_IP}:${DOMU_PORT}
" \ >> '/etc/network/if-up.d/iptables'