I'm setting up KVM virtualization host with policy based routing ( management network for host related traffic like updates,ssh etc, DMZ network routed to VMs)

Setup looks like this (by ^^^ i mean like above to represent tree structure)

#external connectivity
eth0 -> vlan110 -> brhost (
^^^  -> vlan120 -> brguest (

#internal connectivity
brguestA ( -> tapA0
^^^                 -> tapA1
^^^                 -> tapA2
brguestB ( -> tapB0
^^^                 -> tapB1

# ... and so on for each VM group subnet

machines An are in one "switch", Bn in second one etc. Host behaves like router and has iptables installed. Source ip is validated per bridge on iptables level.

In general everything "normal" works but when I'm performing some border case operations it still behaves the way it should, but logs suggest that it's more of coincidence than actual proper functioning. For example:

  • connecting to from VM (different host in management network) which is blocked operation on iptables level (tcp-reset) gives

    (iptables reject log) IN=brguestA OUT=brguest SRC= DST= ...
    IPv4: martian source from on dev brhost

note that OUT interface is actually correct according to what it should do considering logic of host/guest networking separation and even if such packets would be forwarded by host they'd get dropped on firewall anyways. Nevertheless host iptables can't properly reject with tcp-reset so such connections just hang on VM and don't receive reset

  • connecting to from VM gives

    IPv4: martian source from on dev brguestA

and nothing else. Swapping places of 10.0.1.x and 192.168.1.x in those logs makes me really confused and I don't really understand what is meaning of those (which ones is src ip and which one is dst ip). I don't really know what host is trying to do and why it fails. Here's output of my ip rule and ip route:

ip rule
0: from all lookup local
32763: from lookup guest
32764: from lookup guest
32765: from all iif lo lookup host
32766: from all lookup main
32767: from all lookup default

ip route show table host
default via dev brhost proto static dev brhost proto static

ip route show table guest
default via dev brguest proto static dev brguestA proto static dev brguestB proto static
# ... so on for other networks

ip route show table main dev brhost proto static dev brguestA proto static dev brguestB proto static
# ...

I'm using systemd-networkd for network management. I thought it is happening because host always tries to respond using brhost device as being OUTPUT type of packet it has iif set to lo so it's caught by from iif lookup host rule. However it doesn't seem to be a case as connecting to is rejected properly so it doens't always pick brhost as output source.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.