Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : VMWare - WinXP as Guest on CENTOS - Networking

[VydorScope]

OKay here is the set up:

I have a CENTOS 64bit running, with 1 guest OS (WinXP) in a VMWare Server. I have tried the following: I have 6 public IP's attached to my 1 Ethernet card in the CENTOS host.

Try 1:
The Guest OS is set to use "Bridged" Networking. This allows full use of the internet, in both directions. Not exactly optimal, but it does work. I can reach the Guest via RD, which is a requirement for this client. The guest OS is mainly assigned one of the 6 public IP's (x.x.x.118). The problem with this setup is the Guest OS can not reach the host. For example the host has a mail server on it, and when the Guest tries to reach the host, it times out.


Try 2:
The Guest OS is set up to use "NAT" and gets 192.168.100.128 as its IP via DHCP inside of VMWare. The nat config file for VMWare is set to open port 3389 (RD port). Guest OS can reach the host with out any problem, and can reach the internet with out any problem, however I can not RD in to the Guest OS.

I prefer setup number 2 for all the obvious reasons, but I just can not get my IPTables rules to work. This is what I thought should work, but does not:

iptables -t nat -I PREROUTING  -d x.x.x.118 -j DNAT --to-destination=192.168.100.128
iptables -t nat -I POSTROUTING -s 192.168.100.128 -j SNAT --to-source=x.x.x.118

I realize that would have done all traffic, and defeated the benefits of NAT,but since forwarding only 3389 was not working I tried forwarding everything.

Any suggestions?

[StevenG]

You'd be beter to just have 2 VM's running what you need and not have to talk to the host for services at all.

[VydorScope]

Originally Posted by Dotable Steve

You'd be beter to just have 2 VM's running what you need and not have to talk to the host for services at all.

I doubt the 2 VM's would be able to talk to each other? What ever the problem is talking to the host would be the same I would think?

[StevenG]

If the VM's are using bridged mode then they are like any 2 hosts on the internet, so if the VM1 needs to access port 25 on VM2 all it needs to do is access the IP of the VM2 on port 25.. no natting etc.

VMware recommends that you use vm's for all services and not use the host also I think.

Also, you could use host only networking maybe and nat the external to the host only network.. still better to just install a linux vps running the mail server for me anyway.

[VydorScope]

I doubt I have the RAM for 2 VM's. This client is not paying hug bucks for the hardware. If he was, I would have gotten 2 real machines.

There has go to be a way to solve this, I just am failing to find it, and so is google.

[Annex]

Originally Posted by VydorScope

I doubt I have the RAM for 2 VM's. This client is not paying hug bucks for the hardware. If he was, I would have gotten 2 real machines.

There has go to be a way to solve this, I just am failing to find it, and so is google.

Check to make sure the host machine isn't firewalling the port, and also make sure that the mail server allows connections other than 127.0.0.1, however its not advisable as there are many jumps that can be used to gain access to the root machine.

[VydorScope]

Originally Posted by Annex

Check to make sure the host machine isn't firewalling the port, and also make sure that the mail server allows connections other than 127.0.0.1, however its not advisable as there are many jumps that can be used to gain access to the root machine.

Of course the mail server does allow connections from any where, it is the mail server for the domain. I can connect to it from any machine on the internet with out problem. It is a tiny domain does not need much, but does need standard mail/dns/etc services.

[VydorScope]

SOLVED:

Not a perfect solution, but it does work and its to simple for me to come up with. All I had to do with add a second nick to the GUEST and set one to BRIDGE and the other to NAT. Then use hosts file on the GUEST to override the DNS for the HOST to point to the base NAT ip (192.168....). All seems to work that way. Outside world can reach GUEST and GUEST can reach HOST.