I'm trying to add a simple rule to ipfw on my host (mac) to block traffic from a virtualbox client (Win 7) to a specific public IP. The client is using a bridged network interface. I have separately tried each of the following (meaning, I only use one at a time, then flush the rules and try another):
ipfw add 02000 deny tcp from <vbox client IP> to <remote IP> out
ipfw add 02000 reset tcp from <vbox client IP> to <remote IP> out bridged
ipfw add 02000 reset tcp from <vbox client IP> to <remote IP> out via en1
ipfw add 02000 reset tcp from <vbox client IP> to any out via en1
ipfw add 02000 drop ip from <vbox client IP> to any out via en1
ipfw add 02000 reset tcp from <host IP> to <remote IP> out via en1
ipfw add 02000 reset tcp from me to <remote IP> out via en1
ipfw add 02000 reset tcp from me to <remote IP> out
ipfw add 02000 reset tcp from any to <remote IP> out
None of these are having any affect on the traffic. I'm running wireshark on my mac so I can see the traffic from the vbox client continuing to flow. I've used similar rules to successfully block traffic originating from my host (mac) and since I'm using wireshark, I can see that the client traffic is passing through the same interface.
I also tried using a NAT interface for the client. With this, the client traffic shows up with the host's IP and I can successfully block the traffic with:
ipfw add 02000 reset tcp from <host IP> to <remote IP> out via en1
However, I'm asking for a TCP RESET, but I'm getting an ICMP Host Unreachable. VirtualBox seems to be translating the traffic.
Q1) Is there a way in bridged mode to block vbox client traffic using ipfw on the host?
Q2) Is there a way in NAT mode to not translate a TCP RESET to an ICMP Host Unreachable?
Answers to either of these questions will get me on my way. Thanks!
