Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I cannot access to a web application running on a virtual machine hosted by KVM from a machine in a different subnet.

So, I would like to access from the machine 192.168.1.2 (top right in green circle) to a web application running on the virtual machine 192.168.10.1 (bottom middle in red circle)

I added a static route on the netgear router in order to all requests to 192.168.10.0/24 are forwarded to the host machine 192.168.1.1.

Host machine itself has a static route to forward requests to 192.168.10.0/24 through the vmbr1 bridge interface

  • A telnet on 80 port failed from 192.168.1.2 and succeed from the host machine 192.168.1.1.
  • A ping call to virtual machine works from 192.168.1.2 machine to VM
  • A traceroute fails but if I add -I option, traceroute works too.

Thanks you in advance for your help or any clue.

PS: I precise that even if firewall is disabled it's doesn't work too.

iptables -L

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination 

traceroute from physical machine 192.168.1.2 to VM machine 192.168.10.1 => KO

traceroute to 192.168.10.1 (192.168.10.1), 30 hops max, 60 byte packets
 1  192.168.1.254 (192.168.1.254)  2.390 ms  3.004 ms  3.436 ms
 2  * * *
 3  * * *
 ...
 30  * * *

traceroute from VM Machine 192.168.1.2 to physical machine 192.168.10.1 machine => OK

traceroute to 192.168.1.2 (192.168.1.2), 30 hops max, 60 byte packets
 1  192.168.10.254 (192.168.10.254)  0.846 ms  0.648 ms  0.519 ms
 2  192.168.1.2 (192.168.1.2)  5.447 ms  5.277 ms  4.977 ms

A ping from 192.168.1.2 machine to VM machine 192.168.10.1:

ping 192.168.10.1
PING 192.168.10.1 (192.168.10.1) 56(84) bytes of data.
From 192.168.1.254: icmp_seq=1 Redirect Host(New nexthop: 192.168.1.1)
From 192.168.1.254 icmp_seq=1 Redirect Host64 bytes from 192.168.10.1: icmp_seq=1 ttl=63 time=2.77 ms
From 192.168.1.254: icmp_seq=2 Redirect Host(New nexthop: 192.168.1.1)
From 192.168.1.254 icmp_seq=2 Redirect Host64 bytes from 192.168.10.1: icmp_seq=2 ttl=63 time=2.56 ms

On the host machine, routes are well defined and from this host machine I access to web applications of VM's without any problem.

ip route show

default via 192.168.1.254 dev eth0 
192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.1 
192.168.10.0/24 dev vmbr10  proto kernel  scope link  src 192.168.10.254 
192.168.20.0/24 dev vmbr20  proto kernel  scope link  src 192.168.20.254 

Network's diagram

EDIT

When I plug directly the 192.168.1.2 machine (source machine) to the router with a RJ45 cable, it works. Before 192.168.1.2 was connected to router by Wifi. So I think that it's a problem with this router that not apply well static route to machine connected by Wifi. I don't know why but that's weird :S

share|improve this question
1  
traceroute uses UDP random-port packets and ICMP only with -I. This tests you did means ICMP packets can go trhough and back, but not IP packets. Something is blocking/dropping them. You drew a firewalll on the KVM host. what is it blocking/accepting ? –  Kwaio Dec 26 '13 at 18:14
1  
I think you have a routing issue, don't know where by now. What is the result for traceroute and ping from your Netgear router to your Lamp server ? –  krisFR Dec 26 '13 at 19:23
    
I believed that the output of ping from 192.168.1.2 machine was normal because of the static route defined in netgear router. So following what I understand, the ping output tells that the packet are forwarded to the KVM host machine 192.168.1.1 and itself find the destination machine through the vmbr1 bridge. –  BADAOUI Mohamed Dec 26 '13 at 19:30
    
You certainly have a ping/traceroute feature in the Netgear web interface. I agree when you say that packets are forwarded, but ping should not report icmp redirect on a clean setup –  krisFR Dec 26 '13 at 19:50
add comment

1 Answer

The issue you have is because you are using a router with 2 interfaces on the same subnet 192.168.1.0/24.

The 192.168.1.2 machine is sending packets to its default gateway, I assume it is 192.162.1.254, i.e. the router.

However, since the router finds out that the next hop for the packet is another IP on the same subnet, it generates the redirect you see in the ping output.

You need to run the router as a bridge or switch, i.e. no routes are needed since the KVM 192.168.1.1 and the client 192.168.1.2 are both on the same subnet, they do not need a routing protocol to talk.

Also, this means the correct default gateway for the client 192.168.1.2 should be the KVM 192.168.1.1.

Something else, you need to confirm whether you are using the correct default gateway for the KVM, is it really the router ? does the router provide the KVM or client with access to other subnets than the ones drawn here ?

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.