Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a dedicated server running KVM virtualization with n public IP addresses dedicated to n-1 web-facing virtual machines. Now I'd like to set up some web-facing VM's that don't have a dedicated address, but instead will have 2 or 3 ports forwarded for them from the host machine.

Bridge configuration is:

brctl show

enter image description here

Let's say I would like to forward

  • to
  • to

First, I have enabled port forwarding on a host machine by uncommenting # net.ipv4.ip_forward=1 in /etc/sysctl.conf, then I did sysctl -p /etc/sysctl.conf service network restart Then, similar to the recipe in this question, I did:

iptables -t nat -A PREROUTING -p tcp -i br0 --dport 201 -j DNAT --to-destination
iptables -A FORWARD -p tcp -d --dport 201 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -i br0 --dport 801 -j DNAT --to-destination
iptables -A FORWARD -p tcp -d --dport 801 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

I ran ifconfig on a guest machine and checked that its interface eth0, indeed, has the IP address The interface inside of virtual machine is called eth0, is this right?

But it doesn't work:

nmap doesn't show an open port 201 nor 801, and ssh -l root -p 201 gets me

ssh: connect to host port 201: Connection refused

ip route on a host machine returns dev br0 proto kernel scope link src dev virbr0 proto kernel scope link src dev br0 scope link metric 1004 default via dev br0

What am I doing wrong?

share|improve this question

I really don't want to sound like an idiot, I wanted to comment, or pm you. Just wondering if it would matter that you are using private network address space.

share|improve this answer
I might not know what I'm doing, but I think I should use private network address space (192.168.x.x) because I don't have any more available public IP's for that machine, shouldn't I? – Nickolai Leschov Apr 13 '14 at 14:28
Expanded on my actions in the question – Nickolai Leschov Apr 13 '14 at 15:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.