Port Forwarding
You can skip this step if:
- 1.You are using a tunneling solution in the antlet.
- 2.
If, on the other hand, you want to access other services you’ve installed in your antlets, then port forwarding is one way to achieve this.
To start, navigate to the 'Port Forwarding' page from the sidebar.
A port forwarding rule will route traffic going through a specified port on your Antsle, called the Source Port to a specified port on a Destination antlet within your Antsle, called the Destination Port.
To configure a port forwarding rule, click 'Add new' on the right-hand corner of the 'Port Forwarding Rules' table.
Configure the port forwarding rule as below:
Field | Description | Values |
Protocol | Specify the protocol of the traffic that will be allowed with this rule | tcp, udp, or both |
Source IP | Private IP of the Antsle | Pre-populated |
Source Port | Port on the Antsle where traffic will be routed to from outside the Antsle | |
Destination antlet | antlet where traffic will be routed to from the Source | |
Destination Port | Port on the destination antlet where traffic will be routed to from the Source | |
Enabled? | Toggle the port forwarding rule | |
Enabling a port forwarding rule takes a port forwarding rule configuration and actively routes the traffic. If left disabled, the port forwarding rule configuration will be saved, but the traffic will not be routed between the Antsle and the antlet.
To enable a port forwarding rule, click the checkbox as pictured below.
Then confirm by clicking 'Yes, enable this rule!'
To make changes to the port forwarding rule configuration, click the 'Edit' button, as pictured below.
Make any changes as desired, and click 'Save Configuration'.
Although a Port Forwarding Rule is enabled, traffic may not reach the Destination antlet if the Destination Port is blocked by the antlet's firewall. In order to accept traffic coming into an antlet from your Antsle, you will need to open that port using a firewall tool appropriate for the antlet's OS (e.g.
firewalld , iptables, Windows Firewall).Deleting a port forwarding rule will permanently remove the configuration from antMan.
If you would like to disable a port forwarding rule without removing the configuration, simply click the blue checkbox to disable the rule instead. Disabling the rule will prevent traffic from forwarding, while still keeping the configuration in case you need it for later.
To delete a port forwarding rule, click the 'Delete' button as pictured below.
Confirm deletion by clicking 'Yes, delete this rule!'
If you do not have a plan that enables the port forwarding feature, then you can create a “libvirt hook”. This way, the port forwarding will be enabled when the antlet starts, and discarded when the antlet stops.
For that, ssh into your antsle and then issue these commands:
mkdir -p /etc/libvirt/hooks
cd /etc/libvirt/hooks
Now that you are in the /etc/libvirt/hooks directory, use your favorite text editor, such as vim or nano, to create a file named 'qemu' for port forwarding rules to KVM antlets. Name the file 'lxc' if creating port forwarding rules for LXC antlets. Add the contents shown below.
#!/bin/bash
# update: 11/16/2018
antlet_type=`basename "$0"`
# Update the following variables to fit your setup
# Use an equal number of host and guest ports
antlet_name=Ansible
antlet_ipaddr=10.1.1.10
host_ipaddr=192.168.1.3
host_ports=( '3001' )
antlet_ports=( '3001' )
# Perform actions
if [ "${1}" = "${antlet_name}" ]; then
echo `date` hook/${antlet_type} "antlet ${1}" "${2}" >>/var/log/libvirt/hook.log
fi
length=$(( ${#host_ports[@]} - 1 ))
if [ "${1}" = "${antlet_name}" ]; then
if [ "${2}" = "stopped" ] || [ "${2}" = "reconnect" ]; then
for i in `seq 0 $length`; do
echo "`date` hook/${antlet_type} antlet $antlet_name Closing port ${host_ports[$i]} -> ${antlet_ports[$i]} " >>/var/log/libvirt/hook.log
iptables -t nat -D PREROUTING -d ${host_ipaddr} -p udp --dport ${host_ports[$i]} -j DNAT --to ${antlet_ipaddr}:${antlet_ports[$i]}
iptables -D FORWARD -d ${antlet_ipaddr}/32 -p udp -m state --state NEW,ESTABLISHED,RELATED --dport ${antlet_ports[$i]} -j ACCEPT
iptables -t nat -D PREROUTING -d ${host_ipaddr} -p tcp --dport ${host_ports[$i]} -j DNAT --to ${antlet_ipaddr}:${antlet_ports[$i]}
iptables -D FORWARD -d ${antlet_ipaddr}/32 -p tcp -m state --state NEW,ESTABLISHED,RELATED --dport ${antlet_ports[$i]} -j ACCEPT
done
fi
if [ "${2}" = "start" ] || [ "${2}" = "reconnect" ]; then
for i in `seq 0 $length`; do
echo "`date` hook/${antlet_type} antlet $antlet_name Mapping port ${host_ports[$i]} -> ${antlet_ports[$i]} " >>/var/log/libvirt/hook.log
iptables -t nat -A PREROUTING -d ${host_ipaddr} -p tcp --dport ${host_ports[$i]} -j DNAT --to ${antlet_ipaddr}:${antlet_ports[$i]}
iptables -I FORWARD -d ${antlet_ipaddr}/32 -p tcp -m state --state NEW,ESTABLISHED,RELATED --dport ${antlet_ports[$i]} -j ACCEPT
iptables -t nat -A PREROUTING -d ${host_ipaddr} -p udp --dport ${host_ports[$i]} -j DNAT --to ${antlet_ipaddr}:${antlet_ports[$i]}
iptables -I FORWARD -d ${antlet_ipaddr}/32 -p udp -m state --state NEW,ESTABLISHED,RELATED --dport ${antlet_ports[$i]} -j ACCEPT
done
fi
fi
Please adapt these lines to your needs:
antlet_name=Ansible
antlet_ipaddr=10.1.1.10
host_ipaddr=192.168.1.3
host_ports=( '3001' )
antlet_ports=( '3001' )
- antlet_name is the antlet name (case sensitve)
- antlet_ipaddr is the IP address of the antlet as seen in antMan
- host_ipaddr is the Private IP address of the antsle as seen in antMan
- host_ports is the port number(s) of the request comming in to the antsle
- antlet_ports is the target port number(s) of the service on the antlet
The host_ports and antlet_ports do not need to be the same:
host_ports=( '13330' )
antlet_ports=( '3389' )
This can be used to forward traffic to multiple antlets listening on the same port by setting a unique host_ports per antlet. This technique can also add a little security to well known ports.
You can add more ports if needed (use a space between port numbers)
host_ports=( ‘3389’ ‘4444’ ‘2211’)
antlet_ports=( '3389' '4444' '2211')
If you need to forward ports into additional antlets, just duplicate the code within the same hook file. An example could look like this:
#!/bin/bash
# update: 11/16/2018
antlet_type=`basename "$0"`
# Update the following variables to fit your setup
# Use an equal number of host and guest ports
antlet_name=Ansible
antlet_ipaddr=10.1.1.10
host_ipaddr=192.168.1.66
host_ports=( '3001' )
antlet_ports=( '3001' )
# Perform actions
if [ "${1}" = "${antlet_name}" ]; then
echo `date` hook/${antlet_type} "antlet ${1}" "${2}" >>/var/log/libvirt/hook.log
fi
length=$(( ${#host_ports[@]} - 1 ))
if [ "${1}" = "${antlet_name}" ]; then
if [ "${2}" = "stopped" ] || [ "${2}" = "reconnect" ]; then
for i in `seq 0 $length`; do
echo "`date` hook/${antlet_type} antlet $antlet_name Closing port ${host_ports[$i]} -> ${antlet_ports[$i]} " >>/var/log/libvirt/hook.log
iptables -t nat -D PREROUTING -d ${host_ipaddr} -p udp --dport ${host_ports[$i]} -j DNAT --to ${antlet_ipaddr}:${antlet_ports[$i]}
iptables -D FORWARD -d ${antlet_ipaddr}/32 -p udp -m state --state NEW,ESTABLISHED,RELATED --dport ${antlet_ports[$i]} -j ACCEPT
iptables -t nat -D PREROUTING -d ${host_ipaddr} -p tcp --dport ${host_ports[$i]} -j DNAT --to ${antlet_ipaddr}:${antlet_ports[$i]}
iptables -D FORWARD -d ${antlet_ipaddr}/32 -p tcp -m state --state NEW,ESTABLISHED,RELATED --dport ${antlet_ports[$i]} -j ACCEPT
done
fi
if [ "${2}" = "start" ] || [ "${2}" = "reconnect" ]; then
for i in `seq 0 $length`; do
echo "`date` hook/${antlet_type} antlet $antlet_name Mapping port ${host_ports[$i]} -> ${antlet_ports[$i]} " >>/var/log/libvirt/hook.log
iptables -t nat -A PREROUTING -d ${host_ipaddr} -p tcp --dport ${host_ports[$i]} -j DNAT --to ${antlet_ipaddr}:${antlet_ports[$i]}
iptables -I FORWARD -d ${antlet_ipaddr}/32 -p tcp -m state --state NEW,ESTABLISHED,RELATED --dport ${antlet_ports[$i]} -j ACCEPT
iptables -t nat -A PREROUTING -d ${host_ipaddr} -p udp --dport ${host_ports[$i]} -j DNAT --to ${antlet_ipaddr}:${antlet_ports[$i]}
iptables -I FORWARD -d ${antlet_ipaddr}/32 -p udp -m state --state NEW,ESTABLISHED,RELATED --dport ${antlet_ports[$i]} -j ACCEPT
done
fi
fi
# Update the following variables to fit your setup
# Use an equal number of host and guest ports
antlet_name=lamp
antlet_ipaddr=10.1.1.15
host_ipaddr=192.168.1.66
host_ports=( '3306' '21' ) # Expose MySQL and FTP ports
antlet_ports=( '3306' '21' )
# Perform actions
if [ "${1}" = "${antlet_name}" ]; then
echo `date` hook/${antlet_type} "antlet ${1}" "${2}" >>/var/log/libvirt/hook.log
fi
length=$(( ${#host_ports[@]} - 1 ))
if [ "${1}" = "${antlet_name}" ]; then
if [ "${2}" = "stopped" ] || [ "${2}" = "reconnect" ]; then
for i in `seq 0 $length`; do
echo "`date` hook/${antlet_type} antlet $antlet_name Closing port ${host_ports[$i]} -> ${antlet_ports[$i]} " >>/var/log/libvirt/hook.log
iptables -t nat -D PREROUTING -d ${host_ipaddr} -p udp --dport ${host_ports[$i]} -j DNAT --to ${antlet_ipaddr}:${antlet_ports[$i]}
iptables -D FORWARD -d ${antlet_ipaddr}/32 -p udp -m state --state NEW,ESTABLISHED,RELATED --dport ${antlet_ports[$i]} -j ACCEPT
iptables -t nat -D PREROUTING -d ${host_ipaddr} -p tcp --dport ${host_ports[$i]} -j DNAT --to ${antlet_ipaddr}:${antlet_ports[$i]}
iptables -D FORWARD -d ${antlet_ipaddr}/32 -p tcp -m state --state NEW,ESTABLISHED,RELATED --dport ${antlet_ports[$i]} -j ACCEPT
done
fi
if [ "${2}" = "start" ] || [ "${2}" = "reconnect" ]; then
for i in `seq 0 $length`; do
echo "`date` hook/${antlet_type} antlet $antlet_name Mapping port ${host_ports[$i]} -> ${antlet_ports[$i]} " >>/var/log/libvirt/hook.log
iptables -t nat -A PREROUTING -d ${host_ipaddr} -p tcp --dport ${host_ports[$i]} -j DNAT --to ${antlet_ipaddr}:${antlet_ports[$i]}
iptables -I FORWARD -d ${antlet_ipaddr}/32 -p tcp -m state --state NEW,ESTABLISHED,RELATED --dport ${antlet_ports[$i]} -j ACCEPT
iptables -t nat -A PREROUTING -d ${host_ipaddr} -p udp --dport ${host_ports[$i]} -j DNAT --to ${antlet_ipaddr}:${antlet_ports[$i]}
iptables -I FORWARD -d ${antlet_ipaddr}/32 -p udp -m state --state NEW,ESTABLISHED,RELATED --dport ${antlet_ports[$i]} -j ACCEPT
done
fi
fi
IMPORTANT: Make sure there is no blank line before the first line (#!/bin/bash) Note: Only make edits to the hook file when the antlet is Stopped. Note: Windows uses different line endings than linux which are not compatible. You may get errors if you edit in a Windows text editor.
And make make the file executable:
chmod a+x qemu
chmod a+x lxc
When the hook file is first created you may need to reboot the antsle but is not required for future edits. Make edits to the hook file only when the antlet is Stopped.
If you have a second ethernet port enabled (br1, br2 or br3) and it has an IP address on the same network as br0. Use the host_ipaddr of br0 when connecting to the antlet via the port.
Last modified 3yr ago