Home / server / Questions / 667304
In Process
Mike
Asked: 2015-02-13 22:31:46 +0800 CST

KVM guest is unable to access the internet

  • 772

I have a Debian host that has several allocated IPs and KVM with a Debian guest using a bridged network. The guest is completely unable to reach the network, including the LAN or even the host. Pinging the host from the guest produces a Destination Host Unreachable error. If I try to ping the guest from the host, I get a response from the host itself instead of from the guest.

Host's /etc/network/interfaces

# The loopback network interface
auto lo

auto eth1

iface lo inet loopback

allow-hotplug eth1
iface eth1 inet static
        address 108.xxx.xxx.130
        netmask 255.255.255.248
        network 108.xxx.xxx.128
        broadcast 108.xxx.xxx.135
        gateway 108.xxx.xxx.129
        dns-nameservers 127.0.0.1 208.167.225.22 64.237.42.82
        dns-domain example.com
        # dns-* options are implemented by the resolvconf package, if installed

auto eth0
iface eth0 inet manual

auto br0
iface br0 inet static
        address 108.xxx.xxx.132
        netmask 255.255.255.248
        bridge_ports eth0
        bridge_stp on
        bridge_fd 0
        bridge_maxwait 0

Host's bridges:

# brctl show
bridge name     bridge id               STP enabled     interfaces
br0             8000.bc5ff43b621c       yes             eth0
                                                        vnet0
virbr0          8000.000000000000       yes

Host's KVM networks:

# virsh net-list --all
Name                 State      Autostart
-----------------------------------------
br0                  active     yes       
default              active     yes

br0 network config:

<network>
  <name>br0</name>
  <uuid>cc78c850-b182-11e4-ab27-0800200c9a66</uuid>
  <forward mode='bridge'/>
  <bridge name='br0' />
  <mac address='52:54:00:43:58:77'/>
</network>

VM's interface settings:

<interface type='bridge'>
  <mac address='52:54:00:ea:c0:83'/>
  <source bridge='br0'/>
  <model type='virtio'/>
  <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
</interface>

Host's sysctl

# sysctl -p /etc/sysctl.conf
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.ip_forward = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
net.ipv6.conf.eth0.disable_ipv6 = 1
net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-arptables = 0

Host's iptables:

# iptables -vnL
Chain INPUT (policy ACCEPT 16 packets, 3436 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     udp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
    0     0 ACCEPT     tcp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53
    0     0 ACCEPT     udp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            udp dpt:67
    0     0 ACCEPT     tcp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:67

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      virbr0  0.0.0.0/0            192.168.122.0/24     state RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  virbr0 *       192.168.122.0/24     0.0.0.0/0           
    0     0 ACCEPT     all  --  virbr0 virbr0  0.0.0.0/0            0.0.0.0/0           
    0     0 REJECT     all  --  *      virbr0  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 TCPMSS     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x06/0x02 TCPMSS clamp to PMTU

Chain OUTPUT (policy ACCEPT 9 packets, 832 bytes)
 pkts bytes target     prot opt in     out     source               destination

Guest's network settings:

auto eth0
iface eth0 inet static
        address 108.xxx.xxx.132
        netmask 255.255.255.248
        gateway 108.xxx.xxx.129

Edit (after making host and guest IPs different as per shodanshok's answer)

Host's ifconfig:

# ifconfig
br0       Link encap:Ethernet  HWaddr bc:5f:f4:3b:62:1c  
          inet addr:108.xxx.xxx.132  Bcast:108.xxx.xxx.135  Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2584 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:594801 (580.8 KiB)  TX bytes:0 (0.0 B)

eth0      Link encap:Ethernet  HWaddr bc:5f:f4:3b:62:1c  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:21817 errors:0 dropped:0 overruns:0 frame:0
          TX packets:493 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:5806951 (5.5 MiB)  TX bytes:38774 (37.8 KiB)
          Interrupt:20 Memory:f7d00000-f7d20000 

eth1      Link encap:Ethernet  HWaddr 68:05:ca:05:f2:1e  
          inet addr:108.xxx.xxx.130  Bcast:108.xxx.xxx.135  Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:84560 errors:0 dropped:0 overruns:0 frame:0
          TX packets:140042 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:9419446 (8.9 MiB)  TX bytes:157587628 (150.2 MiB)
          Interrupt:16 Memory:f7cc0000-f7ce0000 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:13361 errors:0 dropped:0 overruns:0 frame:0
          TX packets:13361 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:3897517 (3.7 MiB)  TX bytes:3897517 (3.7 MiB)

virbr0    Link encap:Ethernet  HWaddr 3e:14:8f:80:03:75  
          inet addr:192.168.122.1  Bcast:192.168.122.255  Mask:255.255.255.0
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

vnet0     Link encap:Ethernet  HWaddr fe:54:00:ea:c0:83  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:16 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2517 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:500 
          RX bytes:956 (956.0 B)  TX bytes:583780 (570.0 KiB)

Guest's ifconfig:

ifconfig on guest

linux

3 Answers

  1. Your guest has the same IP address than your host's bridge. This is wrong: guest should have a different IP address than host interface.

    As a side note, this is the very reason why pinging your guest address from your host cause a reply coming from the host itself: you are pinging an host IP!

    Try to configure your guest with a free IP address inside your class (eg: 108.xxx.xxx.131) it should work.

    • 1

  2. It looks like the REJECT lines in your FORWARD table are blocking everything.

    • 0

  3. I normally set mine up like this:

    auto eth0
iface eth0 inet manual

auto br0
iface br0 inet manual
    bridge_ports eth0
    bridge_stp off
    bridge_fd 9
    bridge_maxage 12
    bridge_hello 2

    Shutdown the guest, then run ifdown br0 && ifup br0, then startup the guest and configure the interface inside the guest with the static ip information.

    • 0