Network access from VM to host

Question

I am running a simple KVM-based VM on a Ubuntu host. VM is connected to a NAT virtual network. It can be accessed from the host, but cannot connect back to the host.

From the VM, I can ping the host IP, but am unable to run traceroute or ssh to the host. I can however traceroute to the host gateway IP on the local LAN (the router IP).

There is no firewall/iptables running on the host/VM and net.ipv4.ip_forward = 1 is set on the host. What else am I missing here in order to let VM to access the host?

Thank you.

Solution

In my experience, the best way to setup Host <-> Guest communication in KVM, is to set up a second NIC on the VM used specifically for that purpose. There is a good article here that explains the ins and outs:

https://www.furorteutonicus.eu/2013/08/04/enabling-host-guest-networking-with-kvm-macvlan-and-macvtap/

Really, it's as easy as setting up a second network that uses macvlan, or even a bridged network that puts the VM directly on the same network as your host (depending on how you have your networking configured and how you want to lock down VM access to the Host network, this may or may not work for you).

Once you have your second NIC added to your VM, configure a static IP in the guest OS, and then use that for your Host <-> guest communication.

Of course, you'll need to make sure you are allowing the traffic not only on the Host, but also in the guest OS (in the VM).

Comments

[Admin]

How have you configured the host and guest networking?

[Admin]

Thanks @MichaelHampton for looking into my question. I used virt-manager on the host to create a NAT network (virbr0 192.168.100.0/24) for VM. I can access the Internet from VM, but I can't ssh/traceroute to the host at 192.168.2.2. If I ping the host from VM, the traffic only reach virbr0 at 192.168.100.1, not the host interface, according to the tcpdump.

[Admin]

But 192.168.100.1 is the host's IP address!

[Admin]

Got that part. From VM, I can ping to 192.168.2.2 and 192.168.100.1, but cannot traceroute or ssh to them. I can traceroute to 192.168.2.1 though...

[Admin]

I apologize for the lack of information in my original post. When I do traceroute 192.168.2.2, it reaches nowhere and just gives timeout indication (* * *...). The result is the same for 192.168.100.1. If I do traceroute 192.168.2.1, it takes one hop (192.168.100.1) to reach it.

[cody]

Thank you @frontsidebus. I will look into the macvlan solution and report back here. Just a quick wonder: is there any alternative way such as to configure the virbr0 bridge to allow VM<->host traffic? Thank you!

[cody]

The original problem was fixed after purging the iptable rules on the host machine. An application installed earlier made a change to it.

[frontsidebus]

rad. Glad you were able to get it fixed :)