3

I have setup a kvm win7 guest on a debian host. It's been up and running for a while now, but I had not done much with it. What I had done (for sure) was to download putty.

Today I wanted to try and let putty access the host so I had to update the firewall rules. After that I had no internet connection from the guest anymore. Reverting the changes did not help either. So I wonder why I do not have Internet access from the guest anymore. I honestly can not figure out why.

I append here the following info that will most probably be of interest:

current iptable rules: http://pastebin.com/pTnfs5sr

kvm guest xml: http://pastebin.com/U0GhW0px

qemu cmd that runs the guest: http://pastebin.com/htZ4R0FE

ifconfig : http://pastebin.com/uGVN29VZ

Ifconfig shows 2 virtual interfaces: virbr0 which I expect and vnet0 which I do not know how it is setup and why. It does get destroyed and reappears along with virbr0 everytime I run virst net-destroy default and start it again.

thank you in advance for your help.

EDIT: appending the kernel routing table as well:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0   <external IP of Host>  0.0.0.0        UG    0      0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 eth0
192.168.122.0   0.0.0.0         255.255.255.0   U     0      0        0 virbr0
195.251.61.0    0.0.0.0         255.255.255.0   U     0      0        0 eth0
Improve this question

2 Answers 2

Reset to default
6

So to get internet connection to the guest I had to add the following

  1. nat table 

    -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
-A POSTROUTING -s 192.168.122.0/24 -o eth0 -j SNAT --to-source <the host's ip>

so I masquerade all outgoing packets that leave the host with ip from the guest subnet.

  1. filter table

    -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT

Also I allow packets coming from virbr0 to the internet. And then allow replies to be forwarded back to virbr0 (established, related).

  1. filter table again:

    -A INPUT -s 192.168.122.0/24 -i virbr0 -j ACCEPT

finally, allow guest to reach services run on host.

Improve this answer
1
  • 2
    Excellent. I wish I could upvote you again. Commented Feb 19, 2015 at 0:59
0

Can you check out default route IP address?

> route PRINT -4
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      172.16.57.2    172.16.57.210     10

You must to have a valid gateway address to 0.0.0.0 network (I mean, must have a successfully ping response)

Improve this answer
3
  • nothing out of the ordinary with the routing table too... Commented Sep 28, 2014 at 21:49
  • that routing table you posted seems to be from a gnu/linux and you said you windows client was without internet access, you must to check on routing table on client vm. Also you can turn firewall off on windows by: netsh advfirewall set allprofiles state off Commented Sep 28, 2014 at 23:02
  • hi there, i know it was not a problem with the guest. it was a firewall thing. Commented Sep 29, 2014 at 15:13

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.