Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a vmware vm running ubuntu 12.04 server(name=vmhost), with network bridged and full access to the internet.

This vmhost is using the kvm hypervisor and is running a vm(centOS 6.4),network bridged as well.

The vmhost can access internet and can also access its vm, and the vm can access the vmhost. The vm cannot access the internet, nor can I ping/ssh into it from another pc on my subnet.

I have a bridge for the vmhost/its vm and have checked the iptables/routes but haven't found anything. Also I have ip_forwarding. Running tcpdump I see that vmhost can see the packages but does nothing with them. I have also tried disabling the ufw but didn't help.

Infor for VHMOST route:

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         UG    100    0        0 virbr0     *        U     0      0        0 virbr0

The vmhouste Iptables -l
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere             udp dpt:domain
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:domain
ACCEPT     udp  --  anywhere             anywhere             udp dpt:bootps
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:bootps

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere        state RELATED,ESTABLISHED
ACCEPT     all  --     anywhere            
ACCEPT     all  --  anywhere             anywhere            
REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable
REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Interface file:
auto lo
iface lo inet loopback

auto virbr0
iface virbr0 inet static
        bridge_ports eth0
        bridge_fd 9
        bridge_hello 2
        bridge_maxage 12
        bridge_stp off

Brctl show:
bridge name bridge id       STP enabled interfaces
virbr0      8000.000c29f8f8e4   yes     eth0 vnet1
vnet0       8000.000000000000   no   

ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet scope host lo
inet6 ::1/128 scope host 
   valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 02:00:c0:a8:00:20 brd ff:ff:ff:ff:ff:ff
inet brd scope global eth0
inet6 fe80::c0ff:fea8:20/64 scope link 
   valid_lft forever preferred_lft forever

ip route dev eth0  proto kernel  scope link  src 
default via dev eth0 

I will post tcpdump results shortly.

It is also worth mentioning that I am running opennebula with vmhost as my vm host, but I don't think this is the problem.

share|improve this question

You may want to try unbridging all the virtual machines from the NAT so that your router assigns each their own separate IP address using DHCP. Alternatively, try keeping the virtual machines each bridged to the NAT and checking "Replicate physical connection state" for each machine. It seems, intuitively, that one of these should present a consistent, mutually-visible environment for the virtual machines.

share|improve this answer
I would prefer to stick with static Ip's because otherwise things will get much more complicated. Opennebula leases out IPs to the vms(in this example – user2378421 Dec 21 '13 at 9:50
THat is fair. But What happens if you try experimenting? Does it give any different results? You can always go back to static, no? – Mavaddat Javid Dec 21 '13 at 11:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.