1

Assumed I run a Windows guest in a QEMU virtual machine on a Debian host. Hereby the Debian host is a common desktop computer with internet access.

How can I set up a SFTP file exchange between guest and host but prevent the guest (= Windows) from accessing the internet?

  1. Set up a Virtual Network Interface (NIC) for the belonging Windows machine in virt-manager (default setting is network NAT with device virtio)
  2. Install network driver in guest machine (Windows)
  3. Install WinSCP in the guest machine (Windows)

But what then? Where can I prevent public internet access only for this guest? Is this already possible in virt-manager without messing up the host firewall?

Several other guest machines should not be affected by this.

Improve this question
1
  • Give the guest OS an IP and a route to your regular network (specific subnet), but not a default gateway. Or if you use a "bridged" type connection just giving it an IP but no default gateway.
    – ivanivan
    Commented Oct 4, 2018 at 0:24

3 Answers 3

Reset to default
2

I don't use virtmanager, but with plain qemu that's very simple:

qemu-system-x86_64 -net nic -net "user,restrict=on,guestfwd=:10.0.2.1:22-cmd:netcat 127.0.0.1 22,hostfwd=::2222-:22" -enable-kvm   ...  -m 4G -hda windows.qcow2

That's using "user mode" (slirp) networking with the "restrict" mode on, and does some forwardings.

To connect with ssh/scp/sftp from the host to the guest, you use ssh -p 2222 localhost and scp -P 2222 from_file localhost:to_file.

To connect from the guest to the host, you use ssh 10.0.2.1 (or set 10.0.2.1 as the host in whatever dialog box of putty or winscp)

For the restrict=on flag, have a look at my answer here. That may be closer to what you really need than scp or sftp.

Improve this answer
9
  • Thanks for your answer! About restrict=on the manual says: If this option is enabled, the guest will be isolated, i.e. it will not be able to contact the host and no guest IP packets will be routed over the host to the outside. This option does not affect any explicitly set forwarding rules. - That would explicitely claim that network access to the host is not possible anymore as well, no? Or did we already adjust the forwarding rules with the upper part? :-)
    – Dave
    Commented Oct 3, 2018 at 23:12
  • Exactly, except for the forwardings you set explicitly. If you want to give the guest complete access to the host, but not to anything beyond that, you cannot do it without modifying the firewall rules on the host.
    – user313992
    Commented Oct 3, 2018 at 23:17
  • I'm not sure I undestand what 'upper part' you're talking about, but in the man page "forwardings" refer to those set with the guestfwd and hostfwd options of qemu, not to forwardings set with eg. iptables on the host.
    – user313992
    Commented Oct 3, 2018 at 23:30
  • With "upper part" I mean the executable command in your answer including the forwarding rules. :-)
    – Dave
    Commented Oct 4, 2018 at 18:32
  • The order of the restrict=,guestfwd=,hostfwd= suboptions of -net user does not matter, if that's what you're alluding to.
    – user313992
    Commented Oct 4, 2018 at 19:11
1

Create a new virtual network in virt-manager with its connectivity set to Isolated virtual network.

Isolated virtual network

In this configuration, VMs on this network can only access other VMs on the same network and the host (using only the host's IP address for the isolated network).

Improve this answer
1

A simple way is to remove the default gateway from the windows machine settings. That will remove the default route and will only be able to access the "local network". You may need to do the same for both IPv4 and IPv6 and disable any automatic address acquisition method.

Improve this answer
7
  • Almost. Remove the default gw from the guest OS and specify a route to a specific subnet to allow the guest to access LAN resources. You (probably) don't want to also block the host (plus any other guests, etc).
    – ivanivan
    Commented Oct 4, 2018 at 0:26
  • @ivanivan He only asked about access to the host
    – V13
    Commented Oct 4, 2018 at 0:27
  • @V13: Thanks for your answer! So you mean in machine settings I should add a network interface first - hereby: Which network source, which MAC address and which device model should I select?
    – Dave
    Commented Oct 4, 2018 at 18:14
  • @V13 So it would be a very small subnet or just the specific host. Either way, no default route, route to resource desired, done. No messing around on host needed.
    – ivanivan
    Commented Oct 4, 2018 at 20:23
  • @Dave setup the windows box as if you'd set it up with network connectivity, then change the ip address assignment to be static and add an IP address from the correct address and the default mask, but don't add a default gateway. Since you don't want internet access, you shouldn't probably add a DNS either.
    – V13
    Commented Oct 4, 2018 at 22:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .