0

I have a kvm host and 4 kvm guests using default kvm nat networking. Using ip pool 192.168.100.0/24 for kvm guests. It seems that for some reason masquerading/or something else is not working properly and kvm guests cannot access internet.

HOST/GUESTs OS: ubuntu18.04

KVM-HOST

$ ifconfig
    eno1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
            inet 192.168.144.10  netmask 255.255.255.0  broadcast 192.168.144.255
            inet6 fe80::2267:7cff:fee0:262c  prefixlen 64  scopeid 0x20<link>
            ether 20:67:7c:e0:26:2c  txqueuelen 1000  (Ethernet)
            RX packets 73812  bytes 7462718 (7.4 MB)
            RX errors 0  dropped 0  overruns 0  frame 0
            TX packets 17391  bytes 3516773 (3.5 MB)
            TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
            device interrupt 16  


    lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
            inet 127.0.0.1  netmask 255.0.0.0
            inet6 ::1  prefixlen 128  scopeid 0x10<host>
            loop  txqueuelen 1000  (Local Loopback)
            RX packets 4  bytes 336 (336.0 B)
            RX errors 0  dropped 0  overruns 0  frame 0
            TX packets 4  bytes 336 (336.0 B)
            TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

    virbr0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
            inet 192.168.100.1  netmask 255.255.255.0  broadcast 192.168.100.255
            ether 52:54:00:71:89:7d  txqueuelen 1000  (Ethernet)
            RX packets 38965  bytes 5853973 (5.8 MB)
            RX errors 0  dropped 0  overruns 0  frame 0
            TX packets 10762  bytes 915476 (915.4 KB)
            TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

    vnet0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
            inet6 fe80::fc54:ff:fe17:471c  prefixlen 64  scopeid 0x20<link>
            ether fe:54:00:17:47:1c  txqueuelen 1000  (Ethernet)
            RX packets 247888  bytes 61914425 (61.9 MB)
            RX errors 0  dropped 0  overruns 0  frame 0
            TX packets 223635  bytes 46539028 (46.5 MB)
            TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

    vnet1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
            inet6 fe80::fc54:ff:fe61:d6ea  prefixlen 64  scopeid 0x20<link>
            ether fe:54:00:61:d6:ea  txqueuelen 1000  (Ethernet)
            RX packets 4477  bytes 283106 (283.1 KB)
            RX errors 0  dropped 0  overruns 0  frame 0
            TX packets 8871  bytes 515677 (515.6 KB)
            TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

    vnet2: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
            inet6 fe80::fc54:ff:fe64:e006  prefixlen 64  scopeid 0x20<link>
            ether fe:54:00:64:e0:06  txqueuelen 1000  (Ethernet)
            RX packets 290016  bytes 40365195 (40.3 MB)
            RX errors 0  dropped 0  overruns 0  frame 0
            TX packets 300285  bytes 48661082 (48.6 MB)
            TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

    vnet3: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
            inet6 fe80::fc54:ff:fe03:b421  prefixlen 64  scopeid 0x20<link>
            ether fe:54:00:03:b4:21  txqueuelen 1000  (Ethernet)
            RX packets 211423  bytes 40737812 (40.7 MB)
            RX errors 0  dropped 0  overruns 0  frame 0
            TX packets 246550  bytes 48792383 (48.7 MB)
            TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

kvm default network

virsh net-dumpxml default
<network connections='4'>
  <name>default</name>
  <uuid>2f2f7039-e80f-4f4e-a602-34ddd1b7bb27</uuid>
  <forward mode='nat'>
    <nat>
      <port start='1024' end='65535'/>
    </nat>
  </forward>
  <bridge name='virbr0' stp='on' delay='0'/>
  <mac address='52:54:00:71:89:7d'/>
  <ip address='192.168.100.1' netmask='255.255.255.0'>
    <dhcp>
      <range start='192.168.100.100' end='192.168.100.254'/>
    </dhcp>
  </ip>
</network>

route table

route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.144.1   0.0.0.0         UG    0      0        0 eno1
192.168.100.0   0.0.0.0         255.255.255.0   U     0      0        0 virbr0
192.168.144.0   0.0.0.0         255.255.255.0   U     0      0        0 eno1

Iptables

:PREROUTING ACCEPT [2596:230601]
:INPUT ACCEPT [908:85002]
:FORWARD ACCEPT [1601:122544]
:OUTPUT ACCEPT [845:96915]
:POSTROUTING ACCEPT [2225:200011]
-A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
COMMIT
# Completed on Tue Jan 15 13:20:55 2019
# Generated by iptables-save v1.6.1 on Tue Jan 15 13:20:55 2019
*nat
:PREROUTING ACCEPT [261:37308]
:INPUT ACCEPT [142:11821]
:OUTPUT ACCEPT [58:3901]
:POSTROUTING ACCEPT [344:21061]
-A PREROUTING -p tcp -m tcp --dport 8322 -j DNAT --to-destination 192.168.100.3:22
-A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.100.2:80
-A PREROUTING -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.100.2:443
-A PREROUTING -p tcp -m tcp --dport 5443 -j DNAT --to-destination 192.168.100.2:5443
-A PREROUTING -p tcp -m tcp --dport 8222 -j DNAT --to-destination 192.168.100.2:22
-A PREROUTING -p tcp -m tcp --dport 8422 -j DNAT --to-destination 192.168.100.4:22
-A PREROUTING -p tcp -m tcp --dport 8522 -j DNAT --to-destination 192.168.100.5:22
-A POSTROUTING -s 192.168.100.0/24 -d 224.0.0.0/24 -j RETURN
-A POSTROUTING -s 192.168.100.0/24 -d 255.255.255.255/32 -j RETURN
-A POSTROUTING -s 192.168.100.0/24 ! -d 192.168.100.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 192.168.100.0/24 ! -d 192.168.100.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 192.168.100.0/24 ! -d 192.168.100.0/24 -j MASQUERADE
-A POSTROUTING -s 192.168.100.0/24 ! -d 192.168.100.0/24 -j MASQUERADE
COMMIT
# Completed on Tue Jan 15 13:20:55 2019
# Generated by iptables-save v1.6.1 on Tue Jan 15 13:20:55 2019
*filter
:INPUT ACCEPT [364:39120]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [322:42363]
-A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
-A FORWARD -d 192.168.100.3/32 -o virbr0 -j ACCEPT
-A FORWARD -d 192.168.100.2/32 -o virbr0 -j ACCEPT
-A FORWARD -d 192.168.100.4/32 -o virbr0 -j ACCEPT
-A FORWARD -d 192.168.100.5/32 -o virbr0 -j ACCEPT
-A FORWARD -d 192.168.100.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.100.0/24 -i virbr0 -j ACCEPT
-A FORWARD -i virbr0 -o virbr0 -j ACCEPT
-A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -o virbr0 -p udp -m udp --dport 68 -j ACCEPT
COMMIT

ipv4 forwarding

~$ sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1

to forward incoming connection to kvm guests(PREROUTING) is working well.. to forward packets from virbr0 to eno1 seems not to be working at all.

When I try curl zoznam.sk from kvm guest I'll get a connection timed out.. (zoznam.sk public IP is 213.81.185.100)

In the meantime I also tried tcpdump on kvm HOST

sudo tcpdump -n -s0 -i virbr0  host 213.81.185.100
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on virbr0, link-type EN10MB (Ethernet), capture size 262144 bytes
15:05:31.510196 IP 192.168.100.2.47186 > 213.81.185.100.80: Flags [S], seq 945476723, win 29200, options [mss 1460,sackOK,TS val 1512734950 ecr 0,nop,wscale 7], length 0
15:05:32.523286 IP 192.168.100.2.47186 > 213.81.185.100.80: Flags [S], seq 945476723, win 29200, options [mss 1460,sackOK,TS val 1512735963 ecr 0,nop,wscale 7], length 0
15:05:34.539292 IP 192.168.100.2.47186 > 213.81.185.100.80: Flags [S], seq 945476723, win 29200, options [mss 1460,sackOK,TS val 1512737979 ecr 0,nop,wscale 7], length 0


sudo tcpdump -n -s0 -i eno1  host 213.81.185.100
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eno1, link-type EN10MB (Ethernet), capture size 262144 bytes

We can see that packets arrive at virbr0 interface but not at eno1. Any ideas why is this not working? How can I troubleshoot this further?

EDIT

We find out the traffic was going from virbr0 to virbr0 interface.. After adjusting our PREROUTING rules and adding input interface (-i) eno1 to every rule in the chain, it is finally working.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.