Skip to Content

How to Redirect External Requests to a VirtualBox Guest Using iptables

By: Author Alex Lim

Posted on  - Last updated:

Categories Virtualization

Learn how to redirect external requests to a specific port on your host machine to a VirtualBox guest machine using iptables and port forwarding.

VirtualBox is a popular software that allows you to run virtual machines on your host machine. However, sometimes you may want to access a service running on a virtual machine from outside your host machine. For example, you may have a web server running on a Linux guest machine and you want to access it from another device on your network or from the internet. How can you do that?

One way to achieve this is to use iptables and port forwarding. iptables is a tool that allows you to manipulate the network packets on your Linux machine. Port forwarding is a technique that redirects incoming traffic from one port to another port. In this article, we will show you how to use iptables and port forwarding to redirect external requests to a specific port on your host machine to a VirtualBox guest machine.

Prerequisites

Before we start, you need to have the following:

  • A Linux host machine with VirtualBox installed and a public IP address (e.g., 192.168.2.2).
  • A Linux guest machine with a service running on a specific port (e.g., 80) and a private IP address (e.g., 10.0.2.15).
  • A device that can send requests to your host machine (e.g., a laptop or a smartphone).

Steps

To redirect external requests to a VirtualBox guest machine, you need to follow these steps:

Step 1: Enable IP Forwarding on the Host Machine

IP forwarding is a feature that allows your host machine to act as a router and forward packets between different networks. You need to enable this feature on your host machine to allow iptables to redirect packets to your guest machine. To enable IP forwarding, you need to run the following command on your host machine:

sudo sysctl -w net.ipv4.ip_forward=1

This command will set the value of the net.ipv4.ip_forward parameter to 1, which means IP forwarding is enabled. You can check the value of this parameter by running:

sudo sysctl net.ipv4.ip_forward

You should see the output:

net.ipv4.ip_forward = 1

Step 2: Configure Port Forwarding on the VirtualBox Guest Machine

Port forwarding is a feature that allows you to map a port on your host machine to a port on your guest machine. You need to configure this feature on your VirtualBox guest machine to allow iptables to redirect packets to the correct port on your guest machine. To configure port forwarding, you need to follow these steps:

  1. Open the VirtualBox Manager and select your guest machine.
  2. Click on the Settings button and go to the Network tab.
  3. Select the Adapter that is attached to NAT and click on the Port Forwarding button.
  4. Click on the Add button and enter the following information:
    • Name: A descriptive name for the rule (e.g., Web Server).
    • Protocol: The protocol of the service (e.g., TCP).
    • Host IP: The IP address of your host machine (e.g., 192.168.2.2).
    • Host Port: The port on your host machine that you want to redirect (e.g., 8080).
    • Guest IP: The IP address of your guest machine (e.g., 10.0.2.15).
    • Guest Port: The port on your guest machine that runs the service (e.g., 80).
  5. Click on the OK button to save the rule.

This rule will map the port 8080 on your host machine to the port 80 on your guest machine. You can add more rules if you have more services running on different ports on your guest machine.

Step 3: Configure iptables on the Host Machine

iptables is a tool that allows you to manipulate the network packets on your Linux machine. You need to configure iptables on your host machine to redirect external requests to the port forwarding rule that you created on your guest machine. To configure iptables, you need to run the following command on your host machine:

sudo iptables -t nat -A PREROUTING -p tcp -d 192.168.2.2 --dport 8080 -j DNAT --to-destination 127.0.0.1:8080

This command will add a rule to the nat table, in the PREROUTING chain, that matches the following criteria:

  • The protocol is tcp.
  • The destination IP address is 192.168.2.2 (your host machine’s public IP address).
  • The destination port is 8080 (the port on your host machine that you want to redirect).

The action of this rule is to change the destination IP address and port to 127.0.0.1:8080 (the port forwarding rule that you created on your guest machine).

This rule will redirect external requests to the port 8080 on your host machine to the port 80 on your guest machine.

Test

To test if the redirection works, you need to send a request to the port 8080 on your host machine from another device. For example, you can use a web browser and enter the URL:

http://192.168.2.2:8080

You should see the web page that is served by the web server on your guest machine.

Frequently Asked Questions (FAQs)

Question: What is the difference between NAT and Bridged network modes in VirtualBox?

Answer: NAT and Bridged are two network modes that you can use to connect your guest machine to the network. NAT stands for Network Address Translation, and it allows your guest machine to share the IP address of your host machine. Bridged stands for Bridged Adapter, and it allows your guest machine to have its own IP address on the same network as your host machine.

The main difference between NAT and Bridged is that NAT provides more isolation and security for your guest machine, but it also limits the network access and visibility of your guest machine. Bridged provides more network access and visibility for your guest machine, but it also exposes your guest machine to more risks and threats.

Question: How to delete or modify an iptables rule?

Answer: To delete or modify an iptables rule, you need to use the -D or -R option, respectively. For example, to delete the rule that we created in Step 3, you need to run the following command on your host machine:

sudo iptables -t nat -D PREROUTING -p tcp -d 192.168.2.2 --dport 8080 -j DNAT --to-destination 127.0.0.1:8080

To modify the rule, you need to specify the rule number and the new parameters. For example, to change the destination port from 8080 to 8081, you need to run the following command on your host machine:

sudo iptables -t nat -R PREROUTING 1 -p tcp -d 192.168.2.2 --dport 8081 -j DNAT --to-destination 127.0.0.1:8081

The rule number is the position of the rule in the chain. You can use the -L option to list the rules and their numbers.

Summary

In this article, we have explained how to redirect external requests to a specific port on your host machine to a VirtualBox guest machine using iptables and port forwarding. We have also answered some frequently asked questions about iptables and VirtualBox network modes. We hope that this article has helped you to solve your problem and learn more about iptables and VirtualBox.

Disclaimer: This article is for informational purposes only and does not constitute professional advice. We are not responsible for any damage or loss that may result from following the instructions in this article. Please use caution and backup your data before making any changes to your system.