0

I have setup a hook at /etc/libvirt/hooks/qemu with permissions of 755 owned by 0:0 with the following contents:

#!/bin/bash

if [ "${1}" = "virtualmachine" ]; then
  GUEST_IP=192.168.122.2
  GUEST_PORT=1234
  HOST_PORT=1234

  if [ "${2}" = "stopped" ] || [ "${2}" = "reconnect" ]; then
    /sbin/iptables -D FORWARD -o virbr0 -d  $GUEST_IP -j ACCEPT
    /sbin/iptables -t nat -D PREROUTING -p tcp --dport $HOST_PORT -j DNAT --to $GUEST_IP:$GUEST_PORT
  fi
  if [ "${2}" = "start" ] || [ "${2}" = "reconnect" ]; then
    /sbin/iptables -I FORWARD -o virbr0 -d  $GUEST_IP -j ACCEPT
    /sbin/iptables -t nat -I PREROUTING -p tcp --dport $HOST_PORT -j DNAT --to $GUEST_IP:$GUEST_PORT
  fi
fi

However when I start it and attempt to connect via telnet 192.168.1.1 1234 (I know that is not "correct", just checking the port forward) it fails. The service is running and can be connected to directly via a dedicated port. I can't keep the dedicated port however, as I can't dedicate a physical port for each VM.

The host is running Ubuntu server 19.04 and the guest is running Debian 10.

# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere             udp dpt:domain
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:domain
ACCEPT     udp  --  anywhere             anywhere             udp dpt:bootps
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:67

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             192.168.122.2       
ACCEPT     all  --  anywhere             192.168.122.0/24     ctstate RELATED,ESTABLISHED
ACCEPT     all  --  192.168.122.0/24     anywhere            
ACCEPT     all  --  anywhere             anywhere            
REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable
REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere             udp dpt:bootpc
# qemu-system-x86_64 --version
QEMU emulator version 3.1.0 (Debian 1:3.1+dfsg-2ubuntu3.3)
Copyright (c) 2003-2018 Fabrice Bellard and the QEMU Project developers
# libvirtd --version
libvirtd (libvirt) 5.0.0

How can I fix the port forwarding issues?

0

If you run the telnet on the host system, you should extend the rules. To redirect the local-originated packets you should add the DNAT rule into the nat/OUTPUT chain. In your case you should add the line under the corresponded condition (start or reconnect):

/sbin/iptables -t nat -I OUTPUT -p tcp --dport $HOST_PORT -j DNAT --to $GUEST_IP:$GUEST_PORT

Also add the opposite command to remove the rule.

/sbin/iptables -t nat -D OUTPUT -p tcp --dport $HOST_PORT -j DNAT --to $GUEST_IP:$GUEST_PORT

To list the full rule set with counters better use the iptables-save -c command instead the iptables, that shows only the filter table by default.

  • Unfortunately telnet still can not connect to the guest port, it just sits there doing nothing. – gudenau Aug 16 at 22:09
  • It does appear as though the rules are being added, as there are mentions of the VM IP and the service port. – gudenau Aug 16 at 23:48
0

I figured out the issue, turns out I needed to run iptables -t nat -A POSTROUTING -j MASQUERADE.

Now it works!

  • You need to add the WAN-facing interface to that rule, otherwise everything will get masqueraded and stuff will subtly break. Of course the default virtual network should already be masquerading, so you probably still have a problem. – Michael Hampton Aug 17 at 5:39
  • I noticed that the server does not know the IP address of the clients. Which is a bit of an issue. Wonder how I could fix that, and what would the command be to fix the masquerading? – gudenau Aug 20 at 1:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.