I installed a server with libvirt, and I've created a test VM. When I use the default network for it's interface, it gets a private IP and the NATing seems to work fine. I installed OpenVPN, so I have a tun0 interface I want to NAT that VM on now (tun0 has a private IP on 172.16.0.0, I have no control over the vpn server and I have no way of getting more private IPs there). I created the network using the same parameters as the default network, but using 10.99.0.0 for the DHCP (because why not), but when I try to ping something on the Internet from the VM I get an icmp-port-unreachable.
Here is the forward chain in iptables :
0 0 ACCEPT all -- tun0 vpn0 0.0.0.0/0 10.99.0.0/16 ctstate RELATED,ESTABLISHED 0 0 ACCEPT all -- vpn0 tun0 10.99.0.0/16 0.0.0.0/0 0 0 ACCEPT all -- vpn0 vpn0 0.0.0.0/0 0.0.0.0/0 0 0 REJECT all -- * vpn0 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable 15 1244 REJECT all -- vpn0 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable 0 0 ACCEPT all -- eno1 virbr0 0.0.0.0/0 192.168.122.0/24 ctstate RELATED,ESTABLISHED 0 0 ACCEPT all -- virbr0 eno1 192.168.122.0/24 0.0.0.0/0 0 0 ACCEPT all -- virbr0 virbr0 0.0.0.0/0 0.0.0.0/0 0 0 REJECT all -- * virbr0 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable 0 0 REJECT all -- virbr0 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
As you can see, eno1 is the interface leading to internet the default network is using through virbr0, and tun0 is the vpn interface used through the vpn0 interface (that's how I named it in libvirt's config). Looking at the number, the 5th rule is the one matching, for some reason.
Is it possible libvirt isn't properly using the tun0 interface but instead, for some reason, trying to NAT through eno1 ?
Here is it's config :
<network connections='1'> <name>vpn</name> <uuid>2a641009-63db-a0d9-dac2-6204748786db</uuid> <forward dev='tun0' mode='nat'> <nat> <port start='1024' end='65535'/> </nat> <interface dev='tun0'/> </forward> <bridge name='vpn0' stp='on' delay='0'/> <mac address='52:54:00:c2:05:79'/> <ip address='10.99.99.254' netmask='255.255.0.0'> <dhcp> <range start='10.99.99.10' end='10.99.99.250'/> </dhcp> </ip> </network>
I can't see any difference with the default network, except that the default network works.
Thanks for the help