Assumed I run a Windows guest in a QEMU virtual machine on a Debian host. Hereby the Debian host is a common desktop computer with internet access.

How can I set up a SFTP file exchange between guest and host but prevent the guest (= Windows) from accessing the internet?

  1. Set up a Virtual Network Interface (NIC) for the belonging Windows machine in virt-manager (default setting is network NAT with device virtio)
  2. Install network driver in guest machine (Windows)
  3. Install WinSCP in the guest machine (Windows)

But what then? Where can I prevent public internet access only for this guest? Is this already possible in virt-manager without messing up the host firewall?

Several other guest machines should not be affected by this.

  • Give the guest OS an IP and a route to your regular network (specific subnet), but not a default gateway. Or if you use a "bridged" type connection just giving it an IP but no default gateway. – ivanivan Oct 4 '18 at 0:24

Create a new virtual network in virt-manager with its connectivity set to Isolated virtual network.

Isolated virtual network

In this configuration, VMs on this network can only access other VMs on the same network and the host (using only the host's IP address for the isolated network).

| improve this answer | |

I don't use virtmanager, but with plain qemu that's very simple:

qemu-system-x86_64 -net nic -net "user,restrict=on,guestfwd=: 22,hostfwd=::2222-:22" -enable-kvm   ...  -m 4G -hda windows.qcow2 

That's using "user mode" (slirp) networking with the "restrict" mode on, and does some forwardings.

To connect with ssh/scp/sftp from the host to the guest, you use ssh -p 2222 localhost and scp -P 2222 from_file localhost:to_file.

To connect from the guest to the host, you use ssh (or set as the host in whatever dialog box of putty or winscp)

For the restrict=on flag, have a look at my answer here. That may be closer to what you really need than scp or sftp.

| improve this answer | |
  • Thanks for your answer! About restrict=on the manual says: If this option is enabled, the guest will be isolated, i.e. it will not be able to contact the host and no guest IP packets will be routed over the host to the outside. This option does not affect any explicitly set forwarding rules. - That would explicitely claim that network access to the host is not possible anymore as well, no? Or did we already adjust the forwarding rules with the upper part? :-) – Dave Oct 3 '18 at 23:12
  • Exactly, except for the forwardings you set explicitly. If you want to give the guest complete access to the host, but not to anything beyond that, you cannot do it without modifying the firewall rules on the host. – mosvy Oct 3 '18 at 23:17
  • I'm not sure I undestand what 'upper part' you're talking about, but in the man page "forwardings" refer to those set with the guestfwd and hostfwd options of qemu, not to forwardings set with eg. iptables on the host. – mosvy Oct 3 '18 at 23:30
  • With "upper part" I mean the executable command in your answer including the forwarding rules. :-) – Dave Oct 4 '18 at 18:32
  • The order of the restrict=,guestfwd=,hostfwd= suboptions of -net user does not matter, if that's what you're alluding to. – mosvy Oct 4 '18 at 19:11

A simple way is to remove the default gateway from the windows machine settings. That will remove the default route and will only be able to access the "local network". You may need to do the same for both IPv4 and IPv6 and disable any automatic address acquisition method.

| improve this answer | |
  • Almost. Remove the default gw from the guest OS and specify a route to a specific subnet to allow the guest to access LAN resources. You (probably) don't want to also block the host (plus any other guests, etc). – ivanivan Oct 4 '18 at 0:26
  • @ivanivan He only asked about access to the host – V13 Oct 4 '18 at 0:27
  • @V13: Thanks for your answer! So you mean in machine settings I should add a network interface first - hereby: Which network source, which MAC address and which device model should I select? – Dave Oct 4 '18 at 18:14
  • @V13 So it would be a very small subnet or just the specific host. Either way, no default route, route to resource desired, done. No messing around on host needed. – ivanivan Oct 4 '18 at 20:23
  • @Dave setup the windows box as if you'd set it up with network connectivity, then change the ip address assignment to be static and add an IP address from the correct address and the default mask, but don't add a default gateway. Since you don't want internet access, you shouldn't probably add a DNS either. – V13 Oct 4 '18 at 22:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.