1

I am new to virt-manager.

After having configured a virtual network (new interface virbr0) with 2 VMs that should be able to communicate, I discovered that most ports are filtered.

For example, the two nodes are mutually reachable via port 22, but for other ports, for example higher than 9000, I get a no route to host.

trying to connect to the port 80, that is open on host 192.168.122.125, this is what I get with tcpdump:

07:50:55.363767 IP 192.168.122.14.54483 > 192.168.122.125.80: Flags [S], seq 21091821, win 14600, options [mss 1460,sackOK,TS val 313139 ecr 0,nop,wscale 7], length 0
07:50:55.364204 IP 192.168.122.125 > 192.168.122.14: ICMP host 192.168.122.125 unreachable - admin prohibited, length 68

Why is this? Is it possible to remove some filters, to allow at least the nodes to be able to communicate on various ports?

|improve this question
  • Routing usually doesn't care about ports. Probably the target sends ICMP prohibited packets for the higher ports. Run tcpdump while you try to reach those ports and see what happens. – Hauke Laging Dec 19 '14 at 21:21
  • Hi, I just updated the question adding some tcpdump output – fstab Dec 21 '14 at 12:52
1

If you cannot reach another VM there are two possibilities:

  1. The target system blocks the connection with Netfilter (iptables).
  2. libvirt itself blocks on the virtualized LAN (not meaning VLAN), see http://libvirt.org/formatnwfilter.html

In your case it should be a Netfilter problem. You can be sure about that by running tcpdump on the target host, too. you should see the same packets there.

The solution is to adapt the iptables configuration but that is not related to Netfilter but to your distro. Thus you should make that a new question if you have problems with that.

|improve this answer
  • Hi, thanks for your answer! I was able to change the firewall in order to open up ports, and it worked! Now I have a different problem: how to make the changes to the firewall permanent. unix.stackexchange.com/questions/175255/… – fstab Dec 21 '14 at 15:25
  • 1
    @fstab Then you should consider accepting this answer so that the audience can easily see that this problem is solved. – Hauke Laging Dec 21 '14 at 15:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.