2

I have setup a kvm win7 guest on a debian host. It's been up and running for a while now, but I had not done much with it. What I had done (for sure) was to download putty.

Today I wanted to try and let putty access the host so I had to update the firewall rules. After that I had no internet connection from the guest anymore. Reverting the changes did not help either. So I wonder why I do not have Internet access from the guest anymore. I honestly can not figure out why.

I append here the following info that will most probably be of interest:

current iptable rules: http://pastebin.com/pTnfs5sr

kvm guest xml: http://pastebin.com/U0GhW0px

qemu cmd that runs the guest: http://pastebin.com/htZ4R0FE

ifconfig : http://pastebin.com/uGVN29VZ

Ifconfig shows 2 virtual interfaces: virbr0 which I expect and vnet0 which I do not know how it is setup and why. It does get destroyed and reappears along with virbr0 everytime I run virst net-destroy default and start it again.

thank you in advance for your help.

EDIT: appending the kernel routing table as well:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0   <external IP of Host>  0.0.0.0        UG    0      0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 eth0
192.168.122.0   0.0.0.0         255.255.255.0   U     0      0        0 virbr0
195.251.61.0    0.0.0.0         255.255.255.0   U     0      0        0 eth0
5

So to get internet connection to the guest I had to add the following

  1. nat table

    -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
    -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
    -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
    -A POSTROUTING -s 192.168.122.0/24 -o eth0 -j SNAT --to-source <the host's ip>
    

so I masquerade all outgoing packets that leave the host with ip from the guest subnet.

  1. filter table

    -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
    

Also I allow packets coming from virbr0 to the internet. And then allow replies to be forwarded back to virbr0 (established, related).

  1. filter table again:

    -A INPUT -s 192.168.122.0/24 -i virbr0 -j ACCEPT
    

finally, allow guest to reach services run on host.

  • 2
    Excellent. I wish I could upvote you again. – Mike Feb 19 '15 at 0:59
0

Can you check out default route IP address?

> route PRINT -4
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      172.16.57.2    172.16.57.210     10

You must to have a valid gateway address to 0.0.0.0 network (I mean, must have a successfully ping response)

  • nothing out of the ordinary with the routing table too... – nass Sep 28 '14 at 21:49
  • that routing table you posted seems to be from a gnu/linux and you said you windows client was without internet access, you must to check on routing table on client vm. Also you can turn firewall off on windows by: netsh advfirewall set allprofiles state off – Dennis Ruiz Sep 28 '14 at 23:02
  • hi there, i know it was not a problem with the guest. it was a firewall thing. – nass Sep 29 '14 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.