1

I've created a VM guest with libvirt with the default NAT Bridge. (Host and Guest Ubuntu 14.04 Server) After creating allow rules for SSH and enabling ufw - on the guest - i can't connect to the guest anymore.

From syslog (of the guest):

Oct  6 17:36:51 ubuntu kernel: [ 5969.693057] [UFW BLOCK] IN=eth0   
OUT=MAC=52:54:00:ea:b5:2e:fe:54:00:ea:b5:2e:08:00 SRC=192.168.122.1
DST=192.168.122.152 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=5379 DF PROTO=TCP
SPT=34376 DPT=22 WINDOW=29200 RES=0x00 SYN URGP=0

Status of ufw(on the guest):

root@ubuntu:~# ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
Anywhere                   ALLOW IN    148.251.139.136 22/tcp
Anywhere                   ALLOW IN    148.251.139.133 22/tcp
Anywhere                   ALLOW IN    141.7.0.0/16 22/tcp
Anywhere                   ALLOW IN    192.168.122.0/24 22/tcp
Anywhere                   ALLOW IN    192.168.122.1 22/tcp

148.251.139.136 is the IP of the Host, Guest is 192.168.122.152. I have no idea why ufw blocks the allowed IP of the Host/NAT.

If i disable ufw on the guest i can connect from the host via SSH without problems.

edit: for clarification, these are logs of the guest. NAT routing is working. The problem seems to be on the VM guest side.

4
  • disabled (routed)? Oct 7, 2014 at 8:33
  • I second davids statement. You would have to allow routing especially if the host has a different IP network than the guest. For example 192.168.1.96 255.255.255.0 would not connect to 192.168.2.33 255.255.255.0 unless there was a router with BGP enabled
    – Miphix
    Oct 7, 2014 at 9:09
  • Routing on the KVM Host is enabled, i can connect via ssh to the guest if i disable the guests ufw. Oct 7, 2014 at 9:27
  • As long as the guest isn't a router, you don't need to allow routed. That is it can talk to all nets that it is directly connected to. And if it want to connect to computers that are on other LAN:s, it just need to connect to a router that is on a network that the guest is connected too. No need to allow routed for that. Just allow outgoing for the protocol and IP-addresses.
    – Anders
    May 24, 2023 at 8:29

1 Answer 1

1

after much trial and error i finally found the solution:

instead of:

Anywhere                   ALLOW IN    192.168.122.0/24 22/tcp

the correct rule should be:

 22/tcp                     ALLOW IN    192.168.122.0/24

i mistakenly specified the source port instead of the destination port. This was caused by using the short form of the ufw allow command:

ufw allow from 192.168.122.0/24 port 22  proto tcp  

correct form:

ufw allow from 192.168.122.0/24 to any port 22 proto tcp

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .