internal port forwarding with iptables

[Red Squirrel]

Right now I have a windows vm on a linux server. The vm is bridged and has it's own firewall and IP. I cannot block an IP by just adding it to the host's iptables filter as the bridged interface bypasses this.

What I want to do is make it "host only" then use the local host firewall (iptables) to forward traffic to the internal port of the host only IP - only the ports I tell it to.

Would I see any kind of performance impact doing something like this, as opposed to the way it is now?

I'm not yet sure how to do it but I'll do some research. It will have it's own IP still, just that it will route through the physical host's firewall then use the host only interface of the vm. Just want stuff to go through main firewall as it makes it easier for me to just block an IP off the entire server, if I have to.

 

[Nothinman]

No, routing IP traffic requires virtually no power. A 386 could probably saturate whatever Internet connection you've got.

 

[Red Squirrel]

Good to know.

I have not had much luck finding out how to do what I want to do. It's sorta like nating but not quite. Basically what I want to do is have rules like this:

if destination IP is XX and port is NN, send packet to specified IP, and specified port, else just drop.

But I only want to do it for specific destination IP. (the server has about 15 IPs)

Obviously, it needs to also communicate out and under the same IP XX.