libvirt / KVM: forwarding ssl to VM breaks internet on VM

Question

My qemu hook script looks like this:

#!/bin/bash

# IMPORTANT: Change the "VM NAME" string to match your actual VM Name.
# In order to create rules to other VMs, just duplicate the below block and configure
# it accordingly.
if [ "${1}" = "win2k16" ]; then

   # Update the following variables to fit your setup
   GUEST_IP=192.168.122.100
   GUEST_PORT=3389
   HOST_PORT=49305

   if [ "${2}" = "stopped" ] || [ "${2}" = "reconnect" ]; then
        /sbin/iptables -D FORWARD -o virbr0 -d  $GUEST_IP -j ACCEPT
        /sbin/iptables -t nat -D PREROUTING -p tcp --dport $HOST_PORT -j DNAT --to $GUEST_IP:$GUEST_PORT
   fi
   if [ "${2}" = "start" ] || [ "${2}" = "reconnect" ]; then
        /sbin/iptables -I FORWARD -o virbr0 -d  $GUEST_IP -j ACCEPT
        /sbin/iptables -t nat -I PREROUTING -p tcp --dport $HOST_PORT -j DNAT --to $GUEST_IP:$GUEST_PORT
   fi
fi

if [ "${1}" = "win2k16" ]; then

   # Update the following variables to fit your setup
   GUEST_IP=192.168.122.100
   GUEST_PORT=25
   HOST_PORT=25

   if [ "${2}" = "stopped" ] || [ "${2}" = "reconnect" ]; then
        /sbin/iptables -t nat -D PREROUTING -p tcp --dport $HOST_PORT -j DNAT --to $GUEST_IP:$GUEST_PORT
   fi
   if [ "${2}" = "start" ] || [ "${2}" = "reconnect" ]; then
        /sbin/iptables -t nat -I PREROUTING -p tcp --dport $HOST_PORT -j DNAT --to $GUEST_IP:$GUEST_PORT
   fi
fi

if [ "${1}" = "win2k16" ]; then

   # Update the following variables to fit your setup
   GUEST_IP=192.168.122.100
   GUEST_PORT=443
   HOST_PORT=443

   if [ "${2}" = "stopped" ] || [ "${2}" = "reconnect" ]; then
        /sbin/iptables -t nat -D PREROUTING -p tcp --dport $HOST_PORT -j DNAT --to $GUEST_IP:$GUEST_PORT
   fi
   if [ "${2}" = "start" ] || [ "${2}" = "reconnect" ]; then
        /sbin/iptables -t nat -I PREROUTING -p tcp --dport $HOST_PORT -j DNAT --to $GUEST_IP:$GUEST_PORT
   fi
fi

My problem now is, if I have that SSL (Port 443) forwarded to my Windows VM, on the Windows VM I am only able to access google via https, i cant open any other webpage which uses https. http just works fine. When removing the lines for the 443 forward in the hook script, the internet in the VM works again for https pages. What am I missing here?

Answer 1

I solved it myself.

My eth0 interface only has an external IP, so I added "-d [External IP]/32" and now its working fine.

The line looks like that

/sbin/iptables -t nat -A PREROUTING -p tcp -d [external IP]/32 --dport $HOST_PORT -j DNAT --to $GUEST_IP:$GUEST_PORT