KVM guest is unable to access the internet

Question

I have a Debian host that has several allocated IPs and KVM with a Debian guest using a bridged network. The guest is completely unable to reach the network, including the LAN or even the host. Pinging the host from the guest produces a Destination Host Unreachable error. If I try to ping the guest from the host, I get a response from the host itself instead of from the guest.

Host's /etc/network/interfaces

# The loopback network interface
auto lo

auto eth1

iface lo inet loopback

allow-hotplug eth1
iface eth1 inet static
        address 108.xxx.xxx.130
        netmask 255.255.255.248
        network 108.xxx.xxx.128
        broadcast 108.xxx.xxx.135
        gateway 108.xxx.xxx.129
        dns-nameservers 127.0.0.1 208.167.225.22 64.237.42.82
        dns-domain example.com
        # dns-* options are implemented by the resolvconf package, if installed

auto eth0
iface eth0 inet manual

auto br0
iface br0 inet static
        address 108.xxx.xxx.132
        netmask 255.255.255.248
        bridge_ports eth0
        bridge_stp on
        bridge_fd 0
        bridge_maxwait 0

Host's bridges:

# brctl show
bridge name     bridge id               STP enabled     interfaces
br0             8000.bc5ff43b621c       yes             eth0
                                                        vnet0
virbr0          8000.000000000000       yes

Host's KVM networks:

# virsh net-list --all
Name                 State      Autostart
-----------------------------------------
br0                  active     yes       
default              active     yes

br0 network config:

<network>
  <name>br0</name>
  <uuid>cc78c850-b182-11e4-ab27-0800200c9a66</uuid>
  <forward mode='bridge'/>
  <bridge name='br0' />
  <mac address='52:54:00:43:58:77'/>
</network>

VM's interface settings:

<interface type='bridge'>
  <mac address='52:54:00:ea:c0:83'/>
  <source bridge='br0'/>
  <model type='virtio'/>
  <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
</interface>

Host's sysctl

# sysctl -p /etc/sysctl.conf
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.ip_forward = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
net.ipv6.conf.eth0.disable_ipv6 = 1
net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-arptables = 0

Host's iptables:

# iptables -vnL
Chain INPUT (policy ACCEPT 16 packets, 3436 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     udp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
    0     0 ACCEPT     tcp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53
    0     0 ACCEPT     udp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            udp dpt:67
    0     0 ACCEPT     tcp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:67

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      virbr0  0.0.0.0/0            192.168.122.0/24     state RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  virbr0 *       192.168.122.0/24     0.0.0.0/0           
    0     0 ACCEPT     all  --  virbr0 virbr0  0.0.0.0/0            0.0.0.0/0           
    0     0 REJECT     all  --  *      virbr0  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 TCPMSS     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x06/0x02 TCPMSS clamp to PMTU

Chain OUTPUT (policy ACCEPT 9 packets, 832 bytes)
 pkts bytes target     prot opt in     out     source               destination

Guest's network settings:

auto eth0
iface eth0 inet static
        address 108.xxx.xxx.132
        netmask 255.255.255.248
        gateway 108.xxx.xxx.129

Edit (after making host and guest IPs different as per shodanshok's answer)

Host's ifconfig:

# ifconfig
br0       Link encap:Ethernet  HWaddr bc:5f:f4:3b:62:1c  
          inet addr:108.xxx.xxx.132  Bcast:108.xxx.xxx.135  Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2584 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:594801 (580.8 KiB)  TX bytes:0 (0.0 B)

eth0      Link encap:Ethernet  HWaddr bc:5f:f4:3b:62:1c  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:21817 errors:0 dropped:0 overruns:0 frame:0
          TX packets:493 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:5806951 (5.5 MiB)  TX bytes:38774 (37.8 KiB)
          Interrupt:20 Memory:f7d00000-f7d20000 

eth1      Link encap:Ethernet  HWaddr 68:05:ca:05:f2:1e  
          inet addr:108.xxx.xxx.130  Bcast:108.xxx.xxx.135  Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:84560 errors:0 dropped:0 overruns:0 frame:0
          TX packets:140042 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:9419446 (8.9 MiB)  TX bytes:157587628 (150.2 MiB)
          Interrupt:16 Memory:f7cc0000-f7ce0000 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:13361 errors:0 dropped:0 overruns:0 frame:0
          TX packets:13361 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:3897517 (3.7 MiB)  TX bytes:3897517 (3.7 MiB)

virbr0    Link encap:Ethernet  HWaddr 3e:14:8f:80:03:75  
          inet addr:192.168.122.1  Bcast:192.168.122.255  Mask:255.255.255.0
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

vnet0     Link encap:Ethernet  HWaddr fe:54:00:ea:c0:83  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:16 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2517 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:500 
          RX bytes:956 (956.0 B)  TX bytes:583780 (570.0 KiB)

Guest's ifconfig:

ifconfig on guest

shodanshok · Accepted Answer · 2015-02-13 22:53:07Z

1

Your guest has the same IP address than your host's bridge. This is wrong: guest should have a different IP address than host interface.

As a side note, this is the very reason why pinging your guest address from your host cause a reply coming from the host itself: you are pinging an host IP!

Try to configure your guest with a free IP address inside your class (eg: 108.xxx.xxx.131) it should work.

answered Feb 13, 2015 at 22:53

shodanshok

49k7 gold badges115 silver badges182 bronze badges

I tried and it didn't work either. Pinging the host from the guest or vice versa just produces Destination Host Unreachable.
– Mike
Feb 14, 2015 at 3:51
Can you output ifconfig output on both host and guest?
– shodanshok
Feb 14, 2015 at 6:57
I've added it to my question.
– Mike
Feb 14, 2015 at 19:40
Mmm... It seems ok. Can you try to disable rp_filtering on host side? It makes any difference?
– shodanshok
Feb 14, 2015 at 23:17
I just tried that too and it didn't do anything.
– Mike
Feb 15, 2015 at 1:02

| Show 2 more comments

Chris Davies · Accepted Answer · 2015-02-13 08:24:24Z

0

It looks like the REJECT lines in your FORWARD table are blocking everything.

answered Feb 13, 2015 at 8:24

Chris Davies

1,68115 silver badges29 bronze badges

Those lines are added automatically when restarting the libvirt services. I have edited my question to make that a bit clearer. Removing those entries didn't fix the problem.
– Mike
Feb 13, 2015 at 21:00
@Mike. Host interfaces file is using eth1. Bridge is using eth0.
– Chris Davies
Feb 13, 2015 at 21:48
I've got two NICs, eth0 and eth1. eth1 is for the host's connection to the internet and eth0 is for the bridge.
– Mike
Feb 13, 2015 at 22:42
@mike that's fine if that's really what you want, but how are you routing between them? With a VM having an external ip address you would almost always put it on the external interface.
– Chris Davies
Feb 14, 2015 at 13:27
Both NICs are "external". If I remove the bridge on eth0 and configure it normally (with a static IP), I get a ping reply when pinging the IP I give it.
– Mike
Feb 14, 2015 at 18:14

| Show 2 more comments

RyanH · Accepted Answer · 2015-02-17 21:22:48Z

0

I normally set mine up like this:

auto eth0
iface eth0 inet manual

auto br0
iface br0 inet manual
    bridge_ports eth0
    bridge_stp off
    bridge_fd 9
    bridge_maxage 12
    bridge_hello 2

Shutdown the guest, then run ifdown br0 && ifup br0, then startup the guest and configure the interface inside the guest with the static ip information.

answered Feb 17, 2015 at 21:22

RyanH

3671 silver badge6 bronze badges

Add a comment |

Stack Exchange Network

KVM guest is unable to access the internet

Host's /etc/network/interfaces

Host's bridges:

Host's KVM networks:

br0 network config:

VM's interface settings:

Host's sysctl

Host's iptables:

Guest's network settings:

Edit (after making host and guest IPs different as per shodanshok's answer)

Host's ifconfig:

Guest's ifconfig:

3 Answers 3

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged
linux
networking
debian
virtualization
kvm-virtualization
.

Linked

Hot Network Questions

KVM guest is unable to access the internet

Host's /etc/network/interfaces

Host's bridges:

Host's KVM networks:

br0 network config:

VM's interface settings:

Host's sysctl

Host's iptables:

Guest's network settings:

Edit (after making host and guest IPs different as per shodanshok's answer)

Host's ifconfig:

Guest's ifconfig:

3 Answers 3

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged linuxnetworkingdebianvirtualizationkvm-virtualization.

Linked

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
linux
networking
debian
virtualization
kvm-virtualization
.