[libvirt] Libvirt Forwarding Incoming Connections
Hi Libvirt Developers
The link at http://wiki.libvirt.org/page/Networking under "Forwarding
Incoming Connections " for the advanced version of the script is not
working.
We experienced problems with the script in that there is no interface
specified and although the port forwarding worked, it was too global and
caused a loop when we forwarded port 80 to a guest machine that required
outbound port 80 connectivity.
The advanced script might (and probably does) resolve the problems that
we experienced but as it is not available here is our script in the hope
that it may be useful to others.
Start of script:
#!/bin/sh
# derived from script at "http://wiki.libvirt.org/page/Networking"
debugfile=/dev/null
# set debugfile to desired path and uncomment to debug
#debugfile=/mydebugpath/libvirt_hooks_qemu.debug
# ${1} AND ${2} ARE PASSED TO THIS SCRIPT BY LIBVIRTD
VIR_DOMAIN=${1}
ACTION=${2}
echo -e
"VIR_DOMAIN="${VIR_DOMAIN}'\n'"ACTION="${ACTION}'\n'
>
${debugfile}
function setiptables ()
{
local Host_interface=${1}
local Guest_name=${2}
local Guest_ipaddr=${3}
local -a Host_port=("${!4}")
local -a Guest_port=("${!5}")
echo -e
"Host_interface="${Host_interface}'\n'"Guest_name="${Guest_name}'\n'"Guest_ipaddr="${Guest_ipaddr}'\n'"Host_port=
${Host_port[@]}"'\n'"Guest_port=${Guest_port[@]}"'\n'
>> ${debugfile}
length=$(( ${#Host_port[@]} - 1 ))
if [ "${VIR_DOMAIN}" = "${Guest_name}" ]; then
if [ "${ACTION}" = "stopped" -o "${ACTION}"
=
"reconnect" ]; then
for i in `seq 0 $length`; do
PrerouteCmd="iptables -t nat -D PREROUTING -p tcp
--dport ${Host_port[$i]} -j DNAT -i ${Host_interface} --to
${Guest_ipaddr}:${Guest_port[$i]}"
ForwardCmd="iptables -D FORWARD -d
${Guest_ipaddr}/32 -p tcp -m state --state NEW -m tcp --dport
${Guest_port[$i]} -j ACCEPT"
sh -c "${PrerouteCmd}"
sh -c "${ForwardCmd}"
echo -e
${PrerouteCmd}'\n'${ForwardCmd}'\n' >> ${debugfile}
done
fi
if [ "${ACTION}" = "start" -o "${ACTION}" =
"reconnect"
]; then
for i in `seq 0 $length`; do
PrerouteCmd="iptables -t nat -A PREROUTING
-p tcp --dport ${Host_port[$i]} -j DNAT -i ${Host_interface} --to
${Guest_ipaddr}:${Guest_port[$i]}"
ForwardCmd="iptables -I FORWARD -d
${Guest_ipaddr}/32 -p tcp -m state --state NEW -m tcp --dport
${Guest_port[$i]} -j ACCEPT"
sh -c "${PrerouteCmd}"
sh -c "${ForwardCmd}"
echo -e
${PrerouteCmd}'\n'${ForwardCmd}'\n' >> ${debugfile}
done
fi
echo -e '\n' >> ${debugfile}
fi
return 0
}
# **********************************
# Guest1 *
# **********************************
Guest=Guest1
Guest_ip=192.168.122.xxx
# Forwarding from ethernet Interface eno1
interface=eno1
# This will route port 80 on ethernet interface eno1 to Guest IP address
192.168.122.xxx port 8080
# This will route port 443 on ethernet interface eno1 to Guest IP
address 192.168.122.xxx port 443
# use an equal number of guest and host ports
Host_port_array=( '80' '443' )
Guest_port_array=( '8080' '443' )
setiptables ${interface} ${Guest} ${Guest_ip} Host_port_array[@]
Guest_port_array[@]
# Forwarding from vpn interface tun0 (example for openvpn connection)
interface=tun0
# This will route port 3395 on vpn interface tun0 to Guest IP address
192.168.122.xxx port 3395
# use an equal number of guest and host ports
Host_port_array=( '3395' )
Guest_port_array=( '3395' )
setiptables ${interface} ${Guest} ${Guest_ip} Host_port_array[@]
Guest_port_array[@]
# Multiple guest machines can be configured in a similar way
# ********* end of script ***********