On a Linux laptop, I want to give access to locally hosted VM (kvm) from LAN.
I'd like to do DNAT to VM.
Network
client <-- LAN 192.168.3.0/24 --> host <-- bridge 192.168.113.0/24 --> guest
Host
- wlp3s0: 192.168.3.221/24
- br0: 192.168.113.1/24
net.ipv4.ip_forward = 1
- Bridge:
# bridge -d link
16: vnet5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master br0 state forwarding priority 32 cost 100
hairpin off guard off root_block off fastleave off learning on flood on mcast_flood on bcast_flood on mcast_router 1 mcast_to_unicast off neigh_suppress off vlan_tunnel off isolated off locked off
- Routing:
default via 192.168.3.1 dev wlp3s0 proto dhcp src 192.168.3.221 metric 600
192.168.3.0/24 dev wlp3s0 proto kernel scope link src 192.168.3.221 metric 600
192.168.113.0/24 dev br0
- Netfilter rule extract:
table inet filter {
chain forward {
type filter hook forward priority 0; policy drop;
ct state established,related counter accept
ct state invalid counter drop
tcp dport 8080 counter log prefix "forward: " accept
}
}
table ip nat {
chain prerouting {
type nat hook prerouting priority dstnat
tcp dport 8080 counter log prefix "dnat: " dnat to 193.168.113.201:8080
}
chain postrouting {
type nat hook postrouting priority srcnat
iifname br0 oifname wlp3s0 counter masquerade
}
}
Guest
- enp1s0: 192.168.113.201/24
- Routes:
default via 192.168.113.1 dev enp1s0 proto dhcp src 192.168.113.201 metric 100
192.168.113.0/24 dev enp1s0 proto kernel scope link src 192.168.113.201 metric 100
- No firewall
- Service listening on 0.0.0.0:8080
Client
- address: 192.168.3.2
Tests OK
- Ping from host to guest (
ping -c 1 192.168.113.201
) - Curl from host to guest service (
curl -q http://192.168.113.201:8080
) - Access to internet from guest (
curl -q https://serverfault.com
)
Issue
Calling service from another client on LAN (curl -q http://192.168.3.221:8080
) does not reach the guest.
Tcpdump on wlp3s0 interface of the host:
11:10:54.063354 IP 192.168.3.2.43278 > 192.168.3.221.8080: Flags [S], seq 2985774913, win 64240, options [mss 1460,sackOK,TS val 525180874 ecr 0,nop,wscale 7], length 0
11:10:54.063388 IP 192.168.3.2.43278 > 193.168.113.201.8080: Flags [S], seq 2985774913, win 64240, options [mss 1460,sackOK,TS val 525180874 ecr 0,nop,wscale 7], length 0
(I see "forward" and "dnat" lines in syslog when forwarding and filtering are triggered.)
I see no packet on br0 interface of the host.
Please note the second line of tcpdump. Destination is rewritten, but on the wlp3s0 interface!
I also tested with wired Ethernet instead of Wifi: exactly same behavior.
Why the packet is not routed to bridge through br0?
Any hint appreciated!
ssh -L <wifi_ip>:8080:192.168.113.201:8080 [email protected]
, which is functional workaround.