4

I have a question regarding VM port.

Say I have a Virtual Machine and a Host Machine. The opening ports on Host are 80, 22, 443 only. if I opened ports 80, 22, 443 VM it should be working. However if I opened port 21 on VM, will it work? If it works, does it mean the port 21 on Host is opened also?

My understanding is that the network traffic goes from VM's virtual network adapter to Host's physical network adapter. So the ports on these 2 network adapters should match. Am I correct to say this?

Improve this question
1
  • From below answers I think the physical network adapter setting can only be changed by the hypervisor network manager. When a network card setting on VM is changed, if using "NAT network", hypervisor will change the host network card setting because network traffic must go throught host to VM, however, if using "bridged network", hypervisor will not change host network card setting because it will direct the network traffic to VM seperately.
    – Xianlin
    Commented Apr 13, 2012 at 6:22

3 Answers 3

Reset to default
3

In most type 1 hypervisors the networking stack of the hypervisor is what operates the physical NIC. In that case the hypervisor OS simply puts whatever packets that end up on the virtual nic on to the physical nic (likewise in reverse putting packets from the Pnic on the appropriate vnic ). While it is possible to include virtual firewalls in the mix, changing settings on the management OS itself will not affect traffic on any guests.

In type 2 hypervisors a similar process is followed although in that case (as there is an OS hosting the hypervisor), it is possible to route traffic thru the host OS networking stack which would allow firewall settings to apply to inbound and outbound traffic.

Improve this answer
4
  • My understanding from your teaching is that for type 1 hypervisors, the hypervisor networking stack is in charge of the network traffic control instead of the host management os (e.g. windows 2008 r2 server). when add a port 21 on a VM, the hypervisor will add port 21 on the physcial network card but only direct that port 21 traffic to/from that VM. At the same moment, hypvervisor will not change any port settings for the host OS or other VMs so their network traffic remains the same.
    – Xianlin
    Commented Apr 13, 2012 at 6:12
  • In my question above, I assume the Host OS is in charge of the network traffic on the physical network card which is not the case for type 1 hypervisor. For type 2 hypervisor, there is a way to let host OS take in charge of the network traffic on VMs but not necessary as hypervisor on the Host OS is still in charge of the task.
    – Xianlin
    Commented Apr 13, 2012 at 6:16
  • To answer your first comment, Not quite. If you open up port 21 on a guest there is absolutly no effect on the way the hypervisor manages the network. Think of the NIC as no more than a network hub (and in fact many of the same issues with collisions can occur), and the VMs as being plugged into a switch attached to that hub. So when you say that "only direct that port 21 traffic to/from that VM" that's not correct since all traffic destined for that machine will get sent (but since port 21 is the only one open the guest will drop it)
    – Jim B
    Commented Apr 13, 2012 at 15:34
  • For the second comment (about type 2), correct!
    – Jim B
    Commented Apr 13, 2012 at 15:36
5

In general, opening ports on a virtual machine will not cause them to be opened on the host, network firewall, or anywhere else. However, it depends on the virtual host's networking setup. If the traffic is NATted by the host, its firewall may filter it. If the interface is bridged (virtual machines appear to be actual hosts on the network), it is unlikely that the host's firewall will filter it. If you are using host-only networking, opening any port on the VM will have no effect on the outside world except that the host (and possibly other VMs on that host) will be able to connect to the VM on that port.

Improve this answer
4

When the VM is configured to share the network adapter, the host and the guest have different IP addresses on the local network, which can be used to distinguish between a connection to port 80 on the host and port 80 on the guest.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .