NATing through a vpn with libvirt

Question

I installed a server with libvirt, and I've created a test VM. When I use the default network for it's interface, it gets a private IP and the NATing seems to work fine. I installed OpenVPN, so I have a tun0 interface I want to NAT that VM on now (tun0 has a private IP on 172.16.0.0, I have no control over the vpn server and I have no way of getting more private IPs there). I created the network using the same parameters as the default network, but using 10.99.0.0 for the DHCP (because why not), but when I try to ping something on the Internet from the VM I get an icmp-port-unreachable.

Here is the forward chain in iptables :

0     0 ACCEPT     all  --  tun0   vpn0    0.0.0.0/0            10.99.0.0/16         ctstate RELATED,ESTABLISHED
0     0 ACCEPT     all  --  vpn0   tun0    10.99.0.0/16         0.0.0.0/0           
0     0 ACCEPT     all  --  vpn0   vpn0    0.0.0.0/0            0.0.0.0/0           
0     0 REJECT     all  --  *      vpn0    0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
15 1244 REJECT     all  --  vpn0   *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
0     0 ACCEPT     all  --  eno1   virbr0  0.0.0.0/0            192.168.122.0/24     ctstate RELATED,ESTABLISHED
0     0 ACCEPT     all  --  virbr0 eno1    192.168.122.0/24     0.0.0.0/0           
0     0 ACCEPT     all  --  virbr0 virbr0  0.0.0.0/0            0.0.0.0/0           
0     0 REJECT     all  --  *      virbr0  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
0     0 REJECT     all  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable

As you can see, eno1 is the interface leading to internet the default network is using through virbr0, and tun0 is the vpn interface used through the vpn0 interface (that's how I named it in libvirt's config). Looking at the number, the 5th rule is the one matching, for some reason.

Is it possible libvirt isn't properly using the tun0 interface but instead, for some reason, trying to NAT through eno1 ?

Here is it's config :

<network connections='1'>
  <name>vpn</name>
  <uuid>2a641009-63db-a0d9-dac2-6204748786db</uuid>
  <forward dev='tun0' mode='nat'>
    <nat>
      <port start='1024' end='65535'/>
    </nat>
    <interface dev='tun0'/>
  </forward>
  <bridge name='vpn0' stp='on' delay='0'/>
  <mac address='52:54:00:c2:05:79'/>
  <ip address='10.99.99.254' netmask='255.255.0.0'>
    <dhcp>
      <range start='10.99.99.10' end='10.99.99.250'/>
    </dhcp>
  </ip>
</network>

I can't see any difference with the default network, except that the default network works.

Thanks for the help

Answer 1

When libvirt sets up NAT, it doesn't force traffic to flow to any specific physical NIC. The host's routing rules control where NAT'd traffic will flow. IOW, if using the default libvirt virtual network, traffic ought to be able to flow either to your default NIC eno1 or to the VPN via tun0, according to what target IP addr the guest is trying to connect to. When you add a rule <interface dev='tun0'/> in your config, this simply tells libvirt to block traffic to any NIC except tun0. IOW, assuming the original default config for virbr0, did not have <interface ..>' set, then it should have "just worked" with your VPN. Your iptables rules listed, show 'eno1' which suggests you had an <interface dev='eno1'> rule present - you could simply delete that rule