0

I am running sophos XG in a VM using kvm libvirt. I have a 4 port NIC (I350-t4) and 1 motherboard NIC. One of the 4 port NIC is PCI passthrough as the WAN interface (connected to modem). The other 3 NICs of the I350-t4 are bridged on the host for LAN.

This is working well. I can connect my laptop to one of the LAN NIC and get a DHCP address and firewalled internet also works.

Now, I want the host to be assigned an IP by Sophos guest and also get firewalled internet.

To do this, I assigned a static IP to the LAN bridge on the Host to 172.16.16.15 and gateway to 172.16.16.16.

The sophos XG VM has the static IP address set to 172.16.16.16 on the LAN.

From the Host, I can ping the Guest (172.16.16.16) as well as other machines on the LAN such as my laptop (172.16.16.17) and vice versa.

However, I can't access the internet on the host.

Now, I don't want a static IP for the host. I would like sophos to assign the IP using DHCP. How do I achieve this? And how do I get internet working on the host?

VM installation command

virt-install --name=sophos --virt-type=kvm --memory=1024,maxmemory=2048 --vcpus=2,maxvcpus=4 --cpu host --cdrom=/mnt/nas/all/Projects/sophos/SW-17.1.4_MR-4-254.iso --network=bridge=lanbr0,model=virtio --host-device=pci_0000_06_00_3 --graphics=vnc --disk path=/mnt/nas/all/Projects/sophos/sophos.qcow2,size=64,bus=virtio,format=qcow2

On the Host

# /etc/network/interfaces -- configuration file for ifup(8), ifdown(8)
# Generated by debian-installer.

# The loopback interface
auto lo
iface lo inet loopback

auto enp0s31f6
iface enp0s31f6 inet dhcp

iface enp6s0f0 inet dhcp
iface enp6s0f1 inet dhcp
iface enp6s0f2 inet dhcp


auto lanbr0
iface lanbr0 inet static
        bridge_ports    enp6s0f0 enp6s0f1 enp6s0f2
        bridge_stop     off
        bridge_maxwait  0
        bridge_fd       0
        address 172.16.16.15
        netmask 255.255.255.0
        gateway 172.172.16.16

>:~$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         172.172.16.16   0.0.0.0         UG    0      0        0 lanbr0
10.10.0.0       0.0.0.0         255.255.255.0   U     0      0        0 tun0
172.16.16.0     0.0.0.0         255.255.255.0   U     0      0        0 lanbr0

>:~$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: enp0s31f6: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000
    link/ether e0:d5:5e:4d:2b:d1 brd ff:ff:ff:ff:ff:ff
3: enp6s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master lanbr0 state UP group default qlen 1000
    link/ether a0:36:9f:85:b4:a4 brd ff:ff:ff:ff:ff:ff
4: enp6s0f1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq master lanbr0 state DOWN group default qlen 1000
    link/ether a0:36:9f:85:b4:a5 brd ff:ff:ff:ff:ff:ff
5: enp6s0f2: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq master lanbr0 state DOWN group default qlen 1000
    link/ether a0:36:9f:85:b4:a6 brd ff:ff:ff:ff:ff:ff
7: lanbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether a0:36:9f:85:b4:a4 brd ff:ff:ff:ff:ff:ff
    inet 172.16.16.15/24 brd 172.16.16.255 scope global lanbr0
       valid_lft forever preferred_lft forever
    inet6 fe80::a236:9fff:fe85:b4a4/64 scope link
       valid_lft forever preferred_lft forever
8: tun0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 1000
    link/ether e6:6a:d8:8f:ad:96 brd ff:ff:ff:ff:ff:ff
    inet 10.10.0.180/24 brd 10.10.0.255 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 fe80::e46a:d8ff:fe8f:ad96/64 scope link
       valid_lft forever preferred_lft forever
9: vnet0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master lanbr0 state UNKNOWN group default qlen 1000
    link/ether fe:54:00:dd:a8:ec brd ff:ff:ff:ff:ff:ff
    inet6 fe80::fc54:ff:fedd:a8ec/64 scope link
       valid_lft forever preferred_lft forever

>:~$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
From 172.16.16.15 icmp_seq=1 Destination Host Unreachable
From 172.16.16.15 icmp_seq=2 Destination Host Unreachable
From 172.16.16.15 icmp_seq=3 Destination Host Unreachable
^C
--- 8.8.8.8 ping statistics ---
5 packets transmitted, 0 received, +3 errors, 100% packet loss, time 4099ms

>:~$ ping 172.16.16.17
PING 172.16.16.17 (172.16.16.17) 56(84) bytes of data.
64 bytes from 172.16.16.17: icmp_seq=1 ttl=64 time=0.292 ms
64 bytes from 172.16.16.17: icmp_seq=2 ttl=64 time=0.355 ms

On the laptop (IP 172.16.16.17)

[0:14:40] $ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: icmp_seq=0 ttl=113 time=40.324 ms
64 bytes from 8.8.8.8: icmp_seq=1 ttl=113 time=34.793 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=113 time=35.375 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=113 time=35.734 ms

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.