I have a CentOS 7.2 host running Virtual Machine Manager, there are three guest VMs on this host (all are CentOS 7.2)

Two servers (A and B) are on the same network, they have the same Virtual NIC configuration set up with NAT (virbr0). Guest A has an address of and Guest B has address of, both have static IPs configured. Guest A can ping/ssh to Guest B or vice versa.

Guest C is on a different subnet, Virtual NIC configuration also set up with NAT (virbr1). Guest C has a static IP address of

Guest C cannot ping or ssh to either guest A or B. However, both A and B can ping/ssh to C. No routes have been explicitly defined. Firewalld configuration is default for all guests and host machines.

All three guests are able to get out to the internet, get updates, etc. I'm thinking I was supposed to set something up in order for C to ping/ssh A and B. But I can't think of what that should be. Any ideas?

1 Answer 1


There are many ways:

  1. Put C guest machine into the same subnet as on A and B guests.

  2. Use bridge connection instead NAT for C guest machine. Then you will have access to C guest from A and B guests, but C guest won't have access to A and B guests.

  3. Allow forwarding on host server between interfaces virbr0 and virbr1. Run these commands:

    iptables -I FORWARD -i virbr0 -o virbr1 -s -d -j ACCEPT

    iptables -I FORWARD -i virbr1 -o virbr0 -s -d -j ACCEPT

    /etc/init.d/iptables save

  4. Simply add second virtual network card to C machine and connect it to virbr0.

  • I'd like to keep C in a different subnet for now, while I look for a way to address the communication problem. The bridge connection vs NAT still leaves me in the same situation. I am currently able to ping/ssh C from both A and B and the 122.0/24 subnet but cannot ping/ssh A and C from C and the 100.0/24 subnet. Same with the third suggestion. I want to be able to ssh/communication to/from both subnets.
    – jwhstman
    Commented Oct 19, 2016 at 12:23
  • To add some details:
    – jwhstman
    Commented Oct 19, 2016 at 12:24
  • Firewall configuration on all hosts has not been modified, host IP configuration has 2 virtual switches (bridges) virbr1 and virbr0 for the and network created in Virtual Machine Manager. Host ip route command shows the following: $ ip route default via dev enp3s0 proto static metric 100 dev enp3s0 proto kernel scope link src metric 100 dev virbr1 proto kernel scope link src dev virbr0 proto kernel scope link src
    – jwhstman
    Commented Oct 19, 2016 at 12:31
  • Please show iptables rules for forwarding and nat on the virtualization server. Commented Oct 20, 2016 at 17:16
  • I update my answer. Commented Oct 23, 2016 at 19:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .