Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have just set up a Debian guest inside VirtualBox, on a Fedora host. I use two adapters: NAT (internet for the guest, which works fine) and host-only (ssh from host to guest, nfs, etc.). I am able to ssh from host to guest, but not the other way around. Actually, except ping and traceroute, which both give results, all other network related tools give the error: 'No route to host'.

Some information:

The host IP is 192.168.29.1.

axirma@dev:~$ ip addr  

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN  
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00  
inet 127.0.0.1/8 scope host lo  
inet6 ::1/128 scope host  
valid_lft forever preferred_lft forever  
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000  
link/ether 08:00:27:25:1f:71 brd ff:ff:ff:ff:ff:ff  
inet 10.0.2.15/24 brd 10.0.2.255 scope global eth0  
inet6 fe80::a00:27ff:fe25:1f71/64 scope link  
valid_lft forever preferred_lft forever  
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000  
link/ether 08:00:27:6d:16:e6 brd ff:ff:ff:ff:ff:ff  
inet 192.168.29.2/24 brd 192.168.29.255 scope global eth1  
inet6 fe80::a00:27ff:fe6d:16e6/64 scope link  
valid_lft forever preferred_lft forever  
axirma@dev:~$ ip route  
default via 10.0.2.2 dev eth0  
10.0.2.0/24 dev eth0  proto kernel  scope link  src 10.0.2.15  
192.168.29.0/24 dev eth1  proto kernel  scope link  src 192.168.29.2  

axirma@dev:~$ ip route get 192.168.29.1  
192.168.29.1 dev eth1  src 192.168.29.2  
    cache  ipid 0x1910 rtt 7ms rttvar 7ms cwnd 10  

axirma@dev:~$ arp  
Address                  HWtype  HWaddress           Flags Mask            Iface  
10.0.2.2                 ether   52:54:00:12:35:02   C                     eth0  
host                     ether   0a:00:27:00:00:00   C                     eth1  

axirma@dev:~$ ping -c 4 192.168.29.1  
PING 192.168.29.1 (192.168.29.1) 56(84) bytes of data.  
64 bytes from 192.168.29.1: icmp_req=1 ttl=64 time=0.247 ms  
64 bytes from 192.168.29.1: icmp_req=2 ttl=64 time=0.403 ms  
64 bytes from 192.168.29.1: icmp_req=3 ttl=64 time=0.446 ms  
64 bytes from 192.168.29.1: icmp_req=4 ttl=64 time=0.636 ms  

--- 192.168.29.1 ping statistics ---  
4 packets transmitted, 4 received, 0% packet loss, time 3003ms  
rtt min/avg/max/mdev = 0.247/0.433/0.636/0.138 ms  

axirma@dev:~$ traceroute 192.169.29.1  
traceroute to 192.168.29.1 (192.168.29.1), 30 hops max, 60 byte packets  
 1  host (192.168.29.1)  0.152 ms !X  0.141 ms !X  0.143 ms !X  

axirma@dev:~$ nc -vz 192.168.29.1 22  
host [192.168.29.1] 22 (ssh) : No route to host  

axirma@dev:~$ ssh alexandru@192.168.29.1  
ssh: connect to host 192.168.29.1 port 22: No route to host  

Please let me know if I can provide additional information.

share|improve this question
    
Odd... could you try connecting to the host forcing ssh to bind to your eth1 address? The command is ssh -b 192.168.29.2 alexandru@192.168.29.1 –  MariusMatutiae Nov 9 '13 at 13:14
    
@MariusMatutiae I have tried your suggestion and I receive the same "No route to host" result. –  pink-potato Nov 11 '13 at 10:10
add comment

2 Answers

up vote 1 down vote accepted

The problem is that there is a default firewall configured on the Fedora host and its set of rules ends up rejecting incoming packets from the VirtualBox host-only network interface. If we look at the rules below, we see that icmp packets are allowed. This is the reason why ping works.

[alexandru@the-host ~]$ sudo iptables -vL -t filter
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 435K  493M ACCEPT     all  --  any    any     anywhere             anywhere             state RELATED,ESTABLISHED
   15  1559 ACCEPT     icmp --  any    any     anywhere             anywhere            
   20  1054 ACCEPT     all  --  lo     any     anywhere             anywhere            
   51 11040 ACCEPT     udp  --  any    any     anywhere             224.0.0.251          state NEW udp dpt:mdns
25148 1821K REJECT     all  --  any    any     anywhere             anywhere             reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REJECT     all  --  any    any     anywhere             anywhere             reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT 332K packets, 39M bytes)
 pkts bytes target     prot opt in     out     source               destination

The possibility of a firewall crossed my mind when I saw !X appearing in the tracerout output, about which the man page says: 'communication administratively prohibited'. If we look at the firewall rules above we can see that the traceroute udp packets were reaching the last all encompassing REJECT rule of the INPUT chain.

Later, when I debugged with nmap:

axirma@the-guest:~$ nmap -Pn -T4 192.168.57.1

Starting Nmap 6.00 ( http://nmap.org ) at 2013-11-12 16:28 EET
Nmap scan report for 192.168.57.1
Host is up (0.95s latency).
All 1000 scanned ports on 192.168.57.1 are filtered

Nmap done: 1 IP address (1 host up) scanned in 35.69 seconds

It said that all scanned ports are filtered, about which the man page says: '... means that a firewall, filter or other network obstacle is blocking the port'.

After understanding the iptables output it became clear that I needed to add an additional firewall rule for the desired communication to take place. My personal solution is the following addition to /etc/sysconfig/iptables:

-A INPUT -i vboxnet0 -j ACCEPT, just before the all encompassing REJECT of the INPUT chain. vboxnet0 is the host-only network interface created in VirtualBox.

share|improve this answer
    
I've been digging for hours trying to find the answer to the same problem, and sure enough you're right. Somebody added some pretty ridiculous firewall rules…. Thanks –  Auspex Apr 5 at 2:23
add comment

Did you remember to activate DHCP server for Host-only connection in VirtualBox? It is in File -> Preferences -> Network -> Screwdriver.

share|improve this answer
    
I am interested in a static IP setup for the host-only adapter. I have read that the DHCP server needs to be ticked off for such a setup. –  pink-potato Nov 11 '13 at 15:09
    
So now we know what the problem is, a misconfigured host-only network. Did you check that the network assignment in File -> Preferences -> Network -> screwdriver is the same as the one you wish? Can you display the configuration of the corresponding interface in the host? Can you ping from the host to the guest? Should all else fail, mind you, choosing a DHCP configuration for this network will solve your problem. –  MariusMatutiae Nov 11 '13 at 15:26
    
Thank you for your input @MariusMatutiae. –  pink-potato Nov 12 '13 at 16:26
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.