Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have just set up a Debian guest inside VirtualBox, on a Fedora host. I use two adapters: NAT (internet for the guest, which works fine) and host-only (ssh from host to guest, nfs, etc.). I am able to ssh from host to guest, but not the other way around. Actually, except ping and traceroute, which both give results, all other network related tools give the error: 'No route to host'.

Some information:

The host IP is

axirma@dev:~$ ip addr  

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN  
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00  
inet scope host lo  
inet6 ::1/128 scope host  
valid_lft forever preferred_lft forever  
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000  
link/ether 08:00:27:25:1f:71 brd ff:ff:ff:ff:ff:ff  
inet brd scope global eth0  
inet6 fe80::a00:27ff:fe25:1f71/64 scope link  
valid_lft forever preferred_lft forever  
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000  
link/ether 08:00:27:6d:16:e6 brd ff:ff:ff:ff:ff:ff  
inet brd scope global eth1  
inet6 fe80::a00:27ff:fe6d:16e6/64 scope link  
valid_lft forever preferred_lft forever  
axirma@dev:~$ ip route  
default via dev eth0 dev eth0  proto kernel  scope link  src dev eth1  proto kernel  scope link  src  

axirma@dev:~$ ip route get dev eth1  src  
    cache  ipid 0x1910 rtt 7ms rttvar 7ms cwnd 10  

axirma@dev:~$ arp  
Address                  HWtype  HWaddress           Flags Mask            Iface                 ether   52:54:00:12:35:02   C                     eth0  
host                     ether   0a:00:27:00:00:00   C                     eth1  

axirma@dev:~$ ping -c 4  
PING ( 56(84) bytes of data.  
64 bytes from icmp_req=1 ttl=64 time=0.247 ms  
64 bytes from icmp_req=2 ttl=64 time=0.403 ms  
64 bytes from icmp_req=3 ttl=64 time=0.446 ms  
64 bytes from icmp_req=4 ttl=64 time=0.636 ms  

--- ping statistics ---  
4 packets transmitted, 4 received, 0% packet loss, time 3003ms  
rtt min/avg/max/mdev = 0.247/0.433/0.636/0.138 ms  

axirma@dev:~$ traceroute  
traceroute to (, 30 hops max, 60 byte packets  
 1  host (  0.152 ms !X  0.141 ms !X  0.143 ms !X  

axirma@dev:~$ nc -vz 22  
host [] 22 (ssh) : No route to host  

axirma@dev:~$ ssh alexandru@  
ssh: connect to host port 22: No route to host  

Please let me know if I can provide additional information.

share|improve this question
Odd... could you try connecting to the host forcing ssh to bind to your eth1 address? The command is ssh -b alexandru@ –  MariusMatutiae Nov 9 '13 at 13:14
@MariusMatutiae I have tried your suggestion and I receive the same "No route to host" result. –  pink-potato Nov 11 '13 at 10:10

2 Answers 2

up vote 1 down vote accepted

The problem is that there is a default firewall configured on the Fedora host and its set of rules ends up rejecting incoming packets from the VirtualBox host-only network interface. If we look at the rules below, we see that icmp packets are allowed. This is the reason why ping works.

[alexandru@the-host ~]$ sudo iptables -vL -t filter
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 435K  493M ACCEPT     all  --  any    any     anywhere             anywhere             state RELATED,ESTABLISHED
   15  1559 ACCEPT     icmp --  any    any     anywhere             anywhere            
   20  1054 ACCEPT     all  --  lo     any     anywhere             anywhere            
   51 11040 ACCEPT     udp  --  any    any     anywhere             state NEW udp dpt:mdns
25148 1821K REJECT     all  --  any    any     anywhere             anywhere             reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REJECT     all  --  any    any     anywhere             anywhere             reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT 332K packets, 39M bytes)
 pkts bytes target     prot opt in     out     source               destination

The possibility of a firewall crossed my mind when I saw !X appearing in the tracerout output, about which the man page says: 'communication administratively prohibited'. If we look at the firewall rules above we can see that the traceroute udp packets were reaching the last all encompassing REJECT rule of the INPUT chain.

Later, when I debugged with nmap:

axirma@the-guest:~$ nmap -Pn -T4

Starting Nmap 6.00 ( http://nmap.org ) at 2013-11-12 16:28 EET
Nmap scan report for
Host is up (0.95s latency).
All 1000 scanned ports on are filtered

Nmap done: 1 IP address (1 host up) scanned in 35.69 seconds

It said that all scanned ports are filtered, about which the man page says: '... means that a firewall, filter or other network obstacle is blocking the port'.

After understanding the iptables output it became clear that I needed to add an additional firewall rule for the desired communication to take place. My personal solution is the following addition to /etc/sysconfig/iptables:

-A INPUT -i vboxnet0 -j ACCEPT, just before the all encompassing REJECT of the INPUT chain. vboxnet0 is the host-only network interface created in VirtualBox.

share|improve this answer
I've been digging for hours trying to find the answer to the same problem, and sure enough you're right. Somebody added some pretty ridiculous firewall rules…. Thanks –  Auspex Apr 5 at 2:23

Did you remember to activate DHCP server for Host-only connection in VirtualBox? It is in File -> Preferences -> Network -> Screwdriver.

share|improve this answer
I am interested in a static IP setup for the host-only adapter. I have read that the DHCP server needs to be ticked off for such a setup. –  pink-potato Nov 11 '13 at 15:09
So now we know what the problem is, a misconfigured host-only network. Did you check that the network assignment in File -> Preferences -> Network -> screwdriver is the same as the one you wish? Can you display the configuration of the corresponding interface in the host? Can you ping from the host to the guest? Should all else fail, mind you, choosing a DHCP configuration for this network will solve your problem. –  MariusMatutiae Nov 11 '13 at 15:26
Thank you for your input @MariusMatutiae. –  pink-potato Nov 12 '13 at 16:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.