I cannot access to a web application running on a virtual machine hosted by KVM from a machine in a different subnet.

So, I would like to access from the machine (top right in green circle) to a web application running on the virtual machine (bottom middle in red circle)

I added a static route on the netgear router in order to all requests to are forwarded to the host machine

Host machine itself has a static route to forward requests to through the vmbr1 bridge interface

  • A telnet on 80 port failed from and succeed from the host machine
  • A ping call to virtual machine works from machine to VM
  • A traceroute fails but if I add -I option, traceroute works too.

Thanks you in advance for your help or any clue.

PS: I precise that even if firewall is disabled it's doesn't work too.

iptables -L

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination 

traceroute from physical machine to VM machine => KO

traceroute to (, 30 hops max, 60 byte packets
 1 (  2.390 ms  3.004 ms  3.436 ms
 2  * * *
 3  * * *
 30  * * *

traceroute from VM Machine to physical machine machine => OK

traceroute to (, 30 hops max, 60 byte packets
 1 (  0.846 ms  0.648 ms  0.519 ms
 2 (  5.447 ms  5.277 ms  4.977 ms

A ping from machine to VM machine

PING ( 56(84) bytes of data.
From icmp_seq=1 Redirect Host(New nexthop:
From icmp_seq=1 Redirect Host64 bytes from icmp_seq=1 ttl=63 time=2.77 ms
From icmp_seq=2 Redirect Host(New nexthop:
From icmp_seq=2 Redirect Host64 bytes from icmp_seq=2 ttl=63 time=2.56 ms

On the host machine, routes are well defined and from this host machine I access to web applications of VM's without any problem.

ip route show

default via dev eth0 dev eth0  proto kernel  scope link  src dev vmbr10  proto kernel  scope link  src dev vmbr20  proto kernel  scope link  src 

Network's diagram


When I plug directly the machine (source machine) to the router with a RJ45 cable, it works. Before was connected to router by Wifi. So I think that it's a problem with this router that not apply well static route to machine connected by Wifi. I don't know why but that's weird :S

  • 1
    traceroute uses UDP random-port packets and ICMP only with -I. This tests you did means ICMP packets can go trhough and back, but not IP packets. Something is blocking/dropping them. You drew a firewalll on the KVM host. what is it blocking/accepting ? – mveroone Dec 26 '13 at 18:14
  • 1
    I think you have a routing issue, don't know where by now. What is the result for traceroute and ping from your Netgear router to your Lamp server ? – krisFR Dec 26 '13 at 19:23
  • I believed that the output of ping from machine was normal because of the static route defined in netgear router. So following what I understand, the ping output tells that the packet are forwarded to the KVM host machine and itself find the destination machine through the vmbr1 bridge. – BADAOUI Mohamed Dec 26 '13 at 19:30
  • You certainly have a ping/traceroute feature in the Netgear web interface. I agree when you say that packets are forwarded, but ping should not report icmp redirect on a clean setup – krisFR Dec 26 '13 at 19:50

The issue you have is because you are using a router with 2 interfaces on the same subnet

The machine is sending packets to its default gateway, I assume it is, i.e. the router.

However, since the router finds out that the next hop for the packet is another IP on the same subnet, it generates the redirect you see in the ping output.

You need to run the router as a bridge or switch, i.e. no routes are needed since the KVM and the client are both on the same subnet, they do not need a routing protocol to talk.

Also, this means the correct default gateway for the client should be the KVM

Something else, you need to confirm whether you are using the correct default gateway for the KVM, is it really the router ? does the router provide the KVM or client with access to other subnets than the ones drawn here ?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.