I have setup a hook at /etc/libvirt/hooks/qemu
with permissions of 755 owned by 0:0 with the following contents:
#!/bin/bash
if [ "${1}" = "virtualmachine" ]; then
GUEST_IP=192.168.122.2
GUEST_PORT=1234
HOST_PORT=1234
if [ "${2}" = "stopped" ] || [ "${2}" = "reconnect" ]; then
/sbin/iptables -D FORWARD -o virbr0 -d $GUEST_IP -j ACCEPT
/sbin/iptables -t nat -D PREROUTING -p tcp --dport $HOST_PORT -j DNAT --to $GUEST_IP:$GUEST_PORT
fi
if [ "${2}" = "start" ] || [ "${2}" = "reconnect" ]; then
/sbin/iptables -I FORWARD -o virbr0 -d $GUEST_IP -j ACCEPT
/sbin/iptables -t nat -I PREROUTING -p tcp --dport $HOST_PORT -j DNAT --to $GUEST_IP:$GUEST_PORT
fi
fi
However when I start it and attempt to connect via telnet 192.168.1.1 1234
(I know that is not "correct", just checking the port forward) it fails. The service is running and can be connected to directly via a dedicated port. I can't keep the dedicated port however, as I can't dedicate a physical port for each VM.
The host is running Ubuntu server 19.04 and the guest is running Debian 10.
# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dpt:domain
ACCEPT tcp -- anywhere anywhere tcp dpt:domain
ACCEPT udp -- anywhere anywhere udp dpt:bootps
ACCEPT tcp -- anywhere anywhere tcp dpt:67
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere 192.168.122.2
ACCEPT all -- anywhere 192.168.122.0/24 ctstate RELATED,ESTABLISHED
ACCEPT all -- 192.168.122.0/24 anywhere
ACCEPT all -- anywhere anywhere
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dpt:bootpc
# qemu-system-x86_64 --version
QEMU emulator version 3.1.0 (Debian 1:3.1+dfsg-2ubuntu3.3)
Copyright (c) 2003-2018 Fabrice Bellard and the QEMU Project developers
# libvirtd --version
libvirtd (libvirt) 5.0.0
How can I fix the port forwarding issues?