0

I have a new VM via QEMU/KVM which has its own public IP address 7.7.7.7 on my server which has 5.5.5.5 (obviously simplified for this Question).

All connections work with the configuration below if the firewall iptables is inactive / has no rules.

Yesterday I tried to set up iptables IP firewall rules for both server/hypervisor and host/VM but I cannot SSH into the VM any more (ping works!).

How do I allow ssh from external or localhost into the VM? Or is this config already OK? (Then we need to check the VM's IP tables.)

Here are my rules on the hypervisor/server (5.5.5.5) (default DROPs not yet configured - I am too scared):

# iptables -vnL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
36427 4101K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
 2379  143K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:22
  192 14196 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 0
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
  171  7023 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
    6   373 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53 ctstate NEW,ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53 ctstate NEW,ESTABLISHED
 7573  386K DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
22032 1495K ACCEPT     all  --  *      *       0.0.0.0/0            7.7.7.7       
24360 2300K ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0           
 4940  338K ACCEPT     all  --  *      br0     0.0.0.0/0            7.7.7.7       
 1117  135K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED

Chain OUTPUT (policy ACCEPT 3388 packets, 245K bytes)
 pkts bytes target     prot opt in     out     source               destination         
  114  6840 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp multiport dports 22,443
  530 40656 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 0
    2   168 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
35022 8228K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED

This is my connection to the VM:

# brctl show
bridge name bridge id       STP enabled interfaces
br0     8000.fe5400000007   no      vnet0

# ip -4 a
1: lo:  (...)
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: enp3s0: (...)
    inet 5.5.5.5 peer 5.5.5.3/32 brd 5.5.5.5 scope global enp3s0
       valid_lft forever preferred_lft forever
    inet 5.5.5.5/32 scope global enp3s0
       valid_lft forever preferred_lft forever
3: br0: (...)
    link/ether fe:54:00:00:00:07 brd ff:ff:ff:ff:ff:ff
    inet 5.5.5.5/32 brd 5.5.5.5 scope global br0
       valid_lft forever preferred_lft forever
4: vnet0: (...)
   link/ether fe:54:00:11:22:33 brd ff:ff:ff:ff:ff:ff

IP forwarding is enabled (I suppose I need it?)

# cat /proc/sys/net/ipv4/ip_forward
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.