3

I have setup a kvm win7 guest on a debian host. It's been up and running for a while now, but I had not done much with it. What I had done (for sure) was to download putty.

Today I wanted to try and let putty access the host so I had to update the firewall rules. After that I had no internet connection from the guest anymore. Reverting the changes did not help either. So I wonder why I do not have Internet access from the guest anymore. I honestly can not figure out why.

I append here the following info that will most probably be of interest:

current iptable rules: http://pastebin.com/pTnfs5sr

kvm guest xml: http://pastebin.com/U0GhW0px

qemu cmd that runs the guest: http://pastebin.com/htZ4R0FE

ifconfig : http://pastebin.com/uGVN29VZ

Ifconfig shows 2 virtual interfaces: virbr0 which I expect and vnet0 which I do not know how it is setup and why. It does get destroyed and reappears along with virbr0 everytime I run virst net-destroy default and start it again.

thank you in advance for your help.

EDIT: appending the kernel routing table as well:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0   <external IP of Host>  0.0.0.0        UG    0      0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 eth0
192.168.122.0   0.0.0.0         255.255.255.0   U     0      0        0 virbr0
195.251.61.0    0.0.0.0         255.255.255.0   U     0      0        0 eth0

2 Answers 2

6

So to get internet connection to the guest I had to add the following

  1. nat table

    -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
    -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
    -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
    -A POSTROUTING -s 192.168.122.0/24 -o eth0 -j SNAT --to-source <the host's ip>
    

so I masquerade all outgoing packets that leave the host with ip from the guest subnet.

  1. filter table

    -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
    

Also I allow packets coming from virbr0 to the internet. And then allow replies to be forwarded back to virbr0 (established, related).

  1. filter table again:

    -A INPUT -s 192.168.122.0/24 -i virbr0 -j ACCEPT
    

finally, allow guest to reach services run on host.

1
  • 2
    Excellent. I wish I could upvote you again.
    – Mike
    Commented Feb 19, 2015 at 0:59
0

Can you check out default route IP address?

> route PRINT -4
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      172.16.57.2    172.16.57.210     10

You must to have a valid gateway address to 0.0.0.0 network (I mean, must have a successfully ping response)

3
  • nothing out of the ordinary with the routing table too...
    – nass
    Commented Sep 28, 2014 at 21:49
  • that routing table you posted seems to be from a gnu/linux and you said you windows client was without internet access, you must to check on routing table on client vm. Also you can turn firewall off on windows by: netsh advfirewall set allprofiles state off Commented Sep 28, 2014 at 23:02
  • hi there, i know it was not a problem with the guest. it was a firewall thing.
    – nass
    Commented Sep 29, 2014 at 15:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .