I've created a VM guest with libvirt with the default NAT Bridge. (Host and Guest Ubuntu 14.04 Server) After creating allow rules for SSH and enabling ufw - on the guest - i can't connect to the guest anymore.

From syslog (of the guest):

Oct  6 17:36:51 ubuntu kernel: [ 5969.693057] [UFW BLOCK] IN=eth0   
OUT=MAC=52:54:00:ea:b5:2e:fe:54:00:ea:b5:2e:08:00 SRC=
DST= LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=5379 DF PROTO=TCP
SPT=34376 DPT=22 WINDOW=29200 RES=0x00 SYN URGP=0

Status of ufw(on the guest):

root@ubuntu:~# ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
Anywhere                   ALLOW IN 22/tcp
Anywhere                   ALLOW IN 22/tcp
Anywhere                   ALLOW IN 22/tcp
Anywhere                   ALLOW IN 22/tcp
Anywhere                   ALLOW IN 22/tcp is the IP of the Host, Guest is I have no idea why ufw blocks the allowed IP of the Host/NAT.

If i disable ufw on the guest i can connect from the host via SSH without problems.

edit: for clarification, these are logs of the guest. NAT routing is working. The problem seems to be on the VM guest side.

  • disabled (routed)? Oct 7, 2014 at 8:33
  • I second davids statement. You would have to allow routing especially if the host has a different IP network than the guest. For example would not connect to unless there was a router with BGP enabled
    – Miphix
    Oct 7, 2014 at 9:09
  • Routing on the KVM Host is enabled, i can connect via ssh to the guest if i disable the guests ufw. Oct 7, 2014 at 9:27
  • As long as the guest isn't a router, you don't need to allow routed. That is it can talk to all nets that it is directly connected to. And if it want to connect to computers that are on other LAN:s, it just need to connect to a router that is on a network that the guest is connected too. No need to allow routed for that. Just allow outgoing for the protocol and IP-addresses.
    – Anders
    May 24 at 8:29

1 Answer 1


after much trial and error i finally found the solution:

instead of:

Anywhere                   ALLOW IN 22/tcp

the correct rule should be:

 22/tcp                     ALLOW IN

i mistakenly specified the source port instead of the destination port. This was caused by using the short form of the ufw allow command:

ufw allow from port 22  proto tcp  

correct form:

ufw allow from to any port 22 proto tcp

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .