Apparently, there is another nasty snow storm coming to Toronto tomorrow, so I decided to prepare for the possibility that I may need to work from home. While I’ve had SSH working fine, I wasn’t able to access BigBlueButton clients running on the Ubuntu VM from outside of the CDOT network. So I decided to do a bit of research to get my ports open.
I used iptables as my packet forwarding tool and that is what these specific instructions are written for. However, it should be fairly simple to adapt these instructions for the tool of your choice.
Step 1: Open Ports on Arch Linux
Follow the instructions on the iptables wiki page
to install iptables and enable it with systemd. iptables will fail to load if a default rules
file does not exist at the location pointed at by
IPTABLES_CONF. This variable is defined in
/etc/conf.d/iptables, the default location pointed at being
/etc/iptables/iptables.rules. There are
example files in
/etc/iptables to use as templates if you don’t want to start fresh.
/etc/sysctl.conf, make sure the following options are set:
With iptables running correctly, we can now setup some forwarding rules. At a command line, use the following command to open a TCP port of your choosing on your host machine:
$ iptables -A INPUT -p tcp --dport <PORT_NUMBER> -j ACCEPT
<PORT_NUMBER> is the port number you wish to forward to the virtual machine. Add as many rules as
you wish. If you wanted to close a port instead of open one, you can replace the keyword
ACCEPT at the end
of the command with
While we told iptables what new port forwarding rules we want to use, we haven’t yet saved these rules to file. We can do this by running:
$ iptables-save > /etc/iptables/iptables.rules
If you don’t want to overwrite any current rules, you should use
>> rather than
> to append to the end
of the rules file.
Now we need to restart iptables:
$ systemctl restart iptables
At this point, we should be able to access the open ports from outside of the network. Now we need to set up VMWare Player to accept incoming connections from these ports.
Step 2: Port Forward with VMWare Player
At CDOT, we don’t use DHCP for automatic IP assignment, so I cannot use the bridged networking option in VMWare Player.
I’m using the NAT networking option, which is set to the virtual networking device
vmnet8 by default. The settings for
this virtual interface can be found in
/etc/vmware/vmnet8/nat/nat.conf. Open this file in your favourite editor and look
for the section titled
[incomingtcp]. Each line under this section declares an individual port forwarding rule. Here is an
example of one I’m using to forward HTTP traffic from the host to the VM:
80 = <VM-IP>:80
From left to right, the above reads: forward incoming traffic to the host port 80 to the VM IP at port 80.
At this point. you should be able to access your forwarded ports from outside of the network. Huzzah!