这个设置有什么问题？ 主机和客户都是CentOS 6.5
具体来说，我不能在客人身上运行。
我可以愉快地ping /来宾，包括pinging mirrorlist.centos.org
如果我从主机iptables删除端口80规则（见下文），那么yum工作正常。 但是我需要这个规则，所以我可以使用guest作为一个可公开访问的web服务器。
yum更新输出：
Loaded plugins: fastestmirror Determining fastest mirrors Could not retrieve mirrorlist http://mirrorlist.centos.org/?release=6&arch=x86_64&repo=os error was 12: Timeout on http://mirrorlist.centos.org/?release=6&arch=x86_64&repo=os: (28, 'connect() timed out!') Error: Cannot find a valid baseurl for repo: base 来宾有一个192.168.122.47的IP，和我设置了下面的ssh端口转发工作，但百胜没有。
访客iptables已被禁用。
主机iptables：
# Generated by iptables-save v1.4.7 on Sat May 10 15:54:24 2014 *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [4:560] -A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT -A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT -A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT -A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -d 192.168.122.0/24 -o virbr0 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT -A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT -A FORWARD -i virbr0 -o virbr0 -j ACCEPT -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable -A FORWARD -j REJECT --reject-with icmp-host-prohibited COMMIT # Completed on Sat May 10 15:54:24 2014 # Generated by iptables-save v1.4.7 on Sat May 10 15:54:24 2014 *mangle :PREROUTING ACCEPT [4:316] :INPUT ACCEPT [4:316] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [4:560] :POSTROUTING ACCEPT [4:560] -A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill COMMIT # Completed on Sat May 10 15:54:24 2014 # Generated by iptables-save v1.4.7 on Sat May 10 15:54:24 2014 *nat :PREROUTING ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A PREROUTING -p tcp -m tcp --dport 792 -j DNAT --to-destination 192.168.122.47:22 -A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.122.47:80 -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535 -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535 -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE COMMIT # Completed on Sat May 10 15:54:24 2014
你在NAT中; 你不仅在绑定到80端口的连接上，而且还在绑定连接上。 修改NAT规则以指定stream量必须从外部进入，例如，
-A PREROUTING -p tcp -m tcp -i eth0 --dport 80 -j DNAT --to-destination 192.168.122.47:80
它将停止匹配（并干扰）合法的出站stream量到外部的networking服务器。