2

In RHEL 6.1, I'm running 3x VMs and 2x virtual switches as per the following simplified description:

BRIDGES

  • sw-backend
  • sw-dmz

VMs

  • firewall -> eth0: sw-backend and eth1: sw-dmz
  • be-vm -> eth0: sw-backend - default gw is the firewall VM
  • dmz-vm -> eth0: sw-dmz - default gw is the firewall VM

The firewall VM has a rule allowing be-vm to SSH to dmz-vm. I can ping from be-vm to dmz-vm and even establish connections, but no data seems to pass through. i.e:

be-vm# telnet dmz-vm 22
Trying dmz-vm...
Connected to dmz-vm (x.x.x.x)
Escape character is '^]'.

... and that's as far as it gets.

The reason for the title mentioning changes between RHEL5 and RHEL6 is that these exact VMs and networks set-up work fine in RHEL 5.7.

Thanks!

Improve this question
5
  • have you tried running tcpdump to see where exactly the connection fails?
    – dyasny
    Aug 15, 2011 at 10:07
  • Yes... you can see the handshake getting established OK, and a few more packets, then you just see the source re-transmitting and not getting anything back.
    – Gman
    Aug 15, 2011 at 10:35
  • sounds like your firewall rule is one way only, meaning be can send to dmz, but not vice versa.
    – dyasny
    Aug 16, 2011 at 6:33
  • No, that's not it. Otherwise the connection wouldn't even get established. And it worked fine with RHEL5. Turns out it may have been the virtio driver in RHEL5 with a RHEL6 host. Running with e1000 works, as did CentOS 6.
    – Gman
    Aug 24, 2011 at 5:21
  • you didn't update the virtio drivers?
    – dyasny
    Aug 24, 2011 at 5:45

2 Answers 2

Reset to default
1

The following guest is a VM acting as a firewall between 2 other guests:

  • RHEL5 guest on RHEL5 host using virtio_net = works fine
  • RHEL5 guest on RHEL6 host using virtio_net = doesn't work 100%.. packets get dropped after TCP handshake between guests
  • RHEL5 guest on RHEL6 host using e1000 = works fine
  • RHEL6 guest on RHEL6 host using virtio_net = works fine

Hope this helps someone. Very odd!!

Improve this answer
0

"telnet dmz-vm"

Is not SSH per "firewall VM has a rule allowing be-vm to SSH to dmz-vm." Any chance the telnet port 23 is somehow mapped to something else (e.g. SSH)?

Improve this answer
13
  • Oops. Sorry. I meant telnet dmz-vm 22 :)
    – Gman
    Aug 15, 2011 at 1:22
  • Why are you telnetting to it regardless? That is probably the proper telnet response, only what may be missing is the version banner, which may or may not display depending on the actual version.
    – user48838
    Aug 15, 2011 at 4:11
  • SSH or Telnet both fail. Running 'ssh -v <host>' shows that the connection is established and then it just hangs. I've always been able to telnet to port 22 and see the SSH version banner.
    – Gman
    Aug 15, 2011 at 5:34
  • Have you been able to verify that the SSH server is actually working? If so, how?
    – user48838
    Aug 15, 2011 at 6:33
  • Yes. I can ssh from the firewall-vm to both dmz-vm and be-vm. I just can't SSH from be-vm straight to dmz-vm. I've just set-up a CentOS 6 VM exactly the same way the RHEL5 VM was set-up and it works fine (same firewall rules and everything) so it looks like something in RHEL5 but I'm not sure what.
    – Gman
    Aug 15, 2011 at 6:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .