Iptables preventing me from connecting to virtualbox using remote desktop

NotionCommotion · 11-21-2013, 06:17 AM

Hi,

I installed VirtualBox 4.3 on a Centos6.4 basic server (no GUI) box physically located on the LAN downstream of my hardware firewall. I wish to connect to it using Windows Remote Desktop Connection from only clients directly on my LAN. Currently, my hardware firewall doesn't port forward port 3389, however, I will probably later do so, but it will not forward to the server in question, but one of the other Windows clients. If I turn iptables off, I can connect, however, when iptables is on, I cannot connect. Iptables is configured as follows. The Centos server also acts as a webserver, FTP server, and I use webmin, thus have ports 80 (and 443?), 22, and 10000 open. Not really sure what icmp is all about. Is iptables configured correct, and if not, what should I change?

Thank you

Code:

[root@desktop ~]# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:10000
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:80
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:443
REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:3389
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:3389

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
[root@desktop ~]#

zhjim · 11-22-2013, 02:39 AM

The output you gave is working setup?

You see the lines with POLICY in it? Those are the global rules that are effective when all other rules are passed. So having those on ACCEPT just dosn't do anything. Set those to DROP and you'll be safer.

To get the remote desktop to work find out the port thats used and write a allow rule for it. This go into the FORWARD rules I assume. Depending on how you setup the vbox network. Else write rules for INPUT and OUTPUT chain.

OUTPUT could be handled with connection tracking
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT