1

I've created a VM guest with libvirt with the default NAT Bridge. (Host and Guest Ubuntu 14.04 Server) After creating allow rules for SSH and enabling ufw - on the guest - i can't connect to the guest anymore.

From syslog (of the guest):

Oct  6 17:36:51 ubuntu kernel: [ 5969.693057] [UFW BLOCK] IN=eth0   
OUT=MAC=52:54:00:ea:b5:2e:fe:54:00:ea:b5:2e:08:00 SRC=192.168.122.1
DST=192.168.122.152 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=5379 DF PROTO=TCP
SPT=34376 DPT=22 WINDOW=29200 RES=0x00 SYN URGP=0

Status of ufw(on the guest):

root@ubuntu:~# ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
Anywhere                   ALLOW IN    148.251.139.136 22/tcp
Anywhere                   ALLOW IN    148.251.139.133 22/tcp
Anywhere                   ALLOW IN    141.7.0.0/16 22/tcp
Anywhere                   ALLOW IN    192.168.122.0/24 22/tcp
Anywhere                   ALLOW IN    192.168.122.1 22/tcp

148.251.139.136 is the IP of the Host, Guest is 192.168.122.152. I have no idea why ufw blocks the allowed IP of the Host/NAT.

If i disable ufw on the guest i can connect from the host via SSH without problems.

edit: for clarification, these are logs of the guest. NAT routing is working. The problem seems to be on the VM guest side.

3
  • disabled (routed)? – davidbaumann Oct 7 '14 at 8:33
  • I second davids statement. You would have to allow routing especially if the host has a different IP network than the guest. For example 192.168.1.96 255.255.255.0 would not connect to 192.168.2.33 255.255.255.0 unless there was a router with BGP enabled – Miphix Oct 7 '14 at 9:09
  • Routing on the KVM Host is enabled, i can connect via ssh to the guest if i disable the guests ufw. – Patrick Werner Oct 7 '14 at 9:27
0

after much trial and error i finally found the solution:

instead of:

Anywhere                   ALLOW IN    192.168.122.0/24 22/tcp

the correct rule should be:

 22/tcp                     ALLOW IN    192.168.122.0/24

i mistakenly specified the source port instead of the destination port. This was caused by using the short form of the ufw allow command:

ufw allow from 192.168.122.0/24 port 22  proto tcp  

correct form:

ufw allow from 192.168.122.0/24 to any port 22 proto tcp

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.