I have setup a kvm win7 guest on a debian host. It's been up and running for a while now, but I had not done much with it. What I had done (for sure) was to download putty.

Today I wanted to try and let putty access the host so I had to update the firewall rules. After that I had no internet connection from the guest anymore. Reverting the changes did not help either. So I wonder why I do not have Internet access from the guest anymore. I honestly can not figure out why.

I append here the following info that will most probably be of interest:

current iptable rules: http://pastebin.com/pTnfs5sr

kvm guest xml: http://pastebin.com/U0GhW0px

qemu cmd that runs the guest: http://pastebin.com/htZ4R0FE

ifconfig : http://pastebin.com/uGVN29VZ

Ifconfig shows 2 virtual interfaces: virbr0 which I expect and vnet0 which I do not know how it is setup and why. It does get destroyed and reappears along with virbr0 everytime I run virst net-destroy default and start it again.

thank you in advance for your help.

EDIT: appending the kernel routing table as well:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface   <external IP of Host>        UG    0      0        0 eth0     U     1000   0        0 eth0   U     0      0        0 virbr0   U     0      0        0 eth0

2 Answers 2


So to get internet connection to the guest I had to add the following

  1. nat table

    -A POSTROUTING -s ! -d -p tcp -j MASQUERADE --to-ports 1024-65535
    -A POSTROUTING -s ! -d -p udp -j MASQUERADE --to-ports 1024-65535
    -A POSTROUTING -s -o eth0 -j SNAT --to-source <the host's ip>

so I masquerade all outgoing packets that leave the host with ip from the guest subnet.

  1. filter table

    -A FORWARD -s -i virbr0 -j ACCEPT

Also I allow packets coming from virbr0 to the internet. And then allow replies to be forwarded back to virbr0 (established, related).

  1. filter table again:

    -A INPUT -s -i virbr0 -j ACCEPT

finally, allow guest to reach services run on host.

  • 2
    Excellent. I wish I could upvote you again.
    – Mike
    Commented Feb 19, 2015 at 0:59

Can you check out default route IP address?

> route PRINT -4
IPv4 Route Table
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric

You must to have a valid gateway address to network (I mean, must have a successfully ping response)

  • nothing out of the ordinary with the routing table too...
    – nass
    Commented Sep 28, 2014 at 21:49
  • that routing table you posted seems to be from a gnu/linux and you said you windows client was without internet access, you must to check on routing table on client vm. Also you can turn firewall off on windows by: netsh advfirewall set allprofiles state off Commented Sep 28, 2014 at 23:02
  • hi there, i know it was not a problem with the guest. it was a firewall thing.
    – nass
    Commented Sep 29, 2014 at 15:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .