0

I've recently spun up a new Ubuntu 18.04 virtual machine, using image file ubuntu-18.04-server-cloudimg-amd64.img. When the VM came up, there was already an ens3 interface, and my KVM host assigned a default 192.0.2.100/24 IP address to it.

But I needed two new interfaces, so I manually created them as well. They are ens4 and ens5, respectively:

root@ubuntu:~# ifconfig ens4 10.0.0.10/24
root@ubuntu:~# ifconfig ens5 10.10.10.20/24
root@ubuntu:~#
root@ubuntu:~# ifconfig
ens3: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.0.2.100  netmask 255.255.255.0  broadcast 192.0.2.255
        inet6 fe80::f6a7:39ff:fe24:6fd3  prefixlen 64  scopeid 0x20<link>
        ether f4:a7:39:24:6f:d3  txqueuelen 1000  (Ethernet)
        ...etc...

ens4: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.0.0.10  netmask 255.255.255.0  broadcast 10.0.0.255
        inet6 fe80::f6a7:39ff:fe24:6fd2  prefixlen 64  scopeid 0x20<link>
        ether f4:a7:39:24:6f:d2  txqueuelen 1000  (Ethernet)
        ...etc...

ens5: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.10.10.20  netmask 255.255.255.0  broadcast 192.168.71.255
        inet6 fe80::f6a7:39ff:fe24:6fda  prefixlen 64  scopeid 0x20<link>
        ether f4:a7:39:24:6f:da  txqueuelen 1000  (Ethernet)
        ...etc...

root@ubuntu:~#

For now, I'm only going to focus on ens3 and ens5. I notice that I can ping both interfaces from the host machine:

root@KVMhost:~# ping 192.0.2.100
PING 192.0.2.100 (192.0.2.100) 56(84) bytes of data.
64 bytes from 192.0.2.100: icmp_seq=1 ttl=64 time=0.104 ms
64 bytes from 192.0.2.100: icmp_seq=2 ttl=64 time=0.076 ms
64 bytes from 192.0.2.100: icmp_seq=3 ttl=64 time=0.088 ms
^C
--- 192.0.2.100 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 1999ms
rtt min/avg/max/mdev = 0.076/0.089/0.104/0.013 ms
root@KVMhost:~#
root@KVMhost:~# ping 10.10.10.20
PING 10.10.10.20 (10.10.10.20) 56(84) bytes of data.
64 bytes from 10.10.10.20: icmp_seq=1 ttl=64 time=0.216 ms
64 bytes from 10.10.10.20: icmp_seq=2 ttl=64 time=0.158 ms
64 bytes from 10.10.10.20: icmp_seq=3 ttl=64 time=0.100 ms
^C
--- 10.10.10.20 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 1999ms
rtt min/avg/max/mdev = 0.100/0.158/0.216/0.047 ms
root@KVMhost:~#

I can also ping through both interfaces in the reverse direction. So Network Layer 3 works. So far, so good.

Here's the weird part... Using the same IPs as above, I can SSH from the host into Ubuntu's ens3:

root@KVMhost:~# ssh ubuntu@192.0.2.100
ubuntu@192.0.2.100's password: *******
Welcome to Ubuntu 18.04 LTS (GNU/Linux 4.15.0-20-generic x86_64)

Last login: Thu Jun 13 17:46:15 2019 from 192.0.2.254
ubuntu@ubuntu:~$

But once I try the same to Ubuntu's ens5, I can't connect:

root@KVMhost:~# ssh ubuntu@10.10.10.20
ssh: connect to host 10.10.10.20 port 22: Connection timed out
root@KVMhost:~#
root@KVMhost:~#

I did a TCPdump on the Ubuntu and tried the second SSH test again, and here's what I see:

root@ubuntu:~# tcpdump -i ens5
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens5, link-type EN10MB (Ethernet), capture size 262144 bytes
19:08:05.171265 IP 10.10.10.10.46988 > ubuntu.ssh: Flags [S], seq 4112466036, win 29200, options [mss 1460,sackOK,TS val 2621364955 ecr 0,nop,wscale 9], length 0
19:08:05.171295 IP ubuntu.ssh > 10.10.10.10.46988: Flags [S.], seq 2729080149, ack 4112466037, win 28960, options [mss 1460,sackOK,TS val 3132539741 ecr 2621364955,nop,wscale 7], length 0
19:08:06.171804 IP 10.10.10.10.46988 > ubuntu.ssh: Flags [S], seq 4112466036, win 29200, options [mss 1460,sackOK,TS val 2621365956 ecr 0,nop,wscale 9], length 0
19:08:06.171824 IP ubuntu.ssh > 10.10.10.10.46988: Flags [S.], seq 2729080149, ack 4112466037, win 28960, options [mss 1460,sackOK,TS val 3132540741 ecr 2621364955,nop,wscale 7], length 0
^C
root@ubuntu:~#

So SSH packets from the KVM host are successfully traversing the connection and reaching the Ubuntu VM! And yet, when I examine the /var/log/auth.log log, I don't see a record of the host trying to connect. There is literally no reference to the host trying to connect at all.

So, I'm confused. Could this be an Ubuntu thing, where I have to expressly enable SSH on the new interfaces? Or is this some weird virtualization thing? I kind of suspect the former.

Thanks!

  • Seems like the VM are replying to you but you are not completing the TCP handshake, my guess is the local firewall on the KVM host, try to disable it and try again. – Rabin Jun 13 at 22:21
  • @Rabin Thanks for the tip. You are referring to a firewall on the hypervisor, not the firewall within the Ubuntu VM? Thanks! – Pete Jun 14 at 0:16
  • Yes. (you can always drop the FW on both just to make sure) – Rabin Jun 15 at 18:57
  • @Rabin wow, I never considered the hypervisor firewall. I'll have to focus my efforts there, as I've configured the VM's ufw to permit everything. – Pete Jun 15 at 21:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.