<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 04/20/2014 06:31 AM, Patric Buskas
wrote:<br>
</div>
<blockquote
cite="mid:CABG_dstOma48Ma-RTbc98OCFQ_nO+PDmVa0R9ZYiGtACVmRneQ@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>
<div>
<div>
<div>Hi,<br>
<br>
</div>
I'm new to libvirt so please bear with me.<br>
<br>
</div>
I am trying to set up a routed subnet on my laptop with
libvirt, hoping it to be able to communicate with all
servers in my nw.<br>
</div>
My laptop is on a subnet, <a moz-do-not-send="true"
href="http://192.168.2.0/24">192.168.2.0/24</a>, with a
static ip, 192.168.2.27.<br>
</div>
I have "more or less" followed this guide for routed networks,
<a moz-do-not-send="true"
href="https://www.berrange.com/posts/2009/12/13/routed-subnets-without-nat-for-libvirt-managed-virtual-machines-in-fedora/">https://www.berrange.com/posts/2009/12/13/routed-subnets-without-nat-for-libvirt-managed-virtual-machines-in-fedora/</a><br>
</div>
<div>The "more or less" part is that I have a Asus RT-N56U
router with the static route set as in the guide and I'm not
running wifi.<br>
</div>
<div>With this setup I can reach, within the <a
moz-do-not-send="true" href="http://192.168.200.0/24">192.168.200.0/24</a>,
all guests within <a moz-do-not-send="true"
href="http://192.168.200.0/24">192.168.200.0/24</a>,
internet and the laptop but I can not reach any server on the
laptop subnet.<br>
</div>
<div>traceroute from guests to servers in the laptop subnet is
only giving "stars" infinitely<br>
</div>
<div>nmap from guests to services in the laptop subnet is saying
"filtered"<br>
</div>
</div>
</blockquote>
<br>
When you say "laptop subnet", you mean the physical network, i.e.
192.168.2.0/24, correct?<br>
<br>
If your guests can reach the internet, then 1) the laptop has
ip_forwarding set correctly, and 2) your router has a proper static
IP to get the response packets back to the guest. And I would assume
that the laptop is properly routing packets from guests that are
destined for the directly-connected 192.168.2.0/24 subnet. So the
two possible failure points left are:<br>
<br>
1) possibly the laptop has some other iptables rule setup externally
to libvirt which blocks either the outgoing packets towards
192.168.2.0, or incoming responses from 192.168.2.0. You should run
tcpdump on the laptop's eth0 (and on the servers on the physical
net) looking for packets with the guest & physical server's IP
addresses to see just how far the outgoing packet gets (or if it
gets all the way, how far back the response gets); that can give you
a clue where rules need to be tweaked. (based on the output of
iptable -L, this doesn't seem likely, but you should still verify
it)<br>
<br>
2) possibly your router isn't properly redirecting packets from
192.168.2.0 that are destined for 192.168.200.0 back out the same
interface they arrived on (that would be a broken router, but I've
seen worse things happen in consumer grade networking equipment).
Again, you should run tcpdump on the server to see what kind of
traffic it is sending out for response, and to what *MAC* address it
is sending it (is it going to the router, or directly to the laptop
- add "-e" to the tcpdump commandline to see the ethernet (MAC)
addresses of all logged packets.<br>
<br>
<br>
<blockquote
cite="mid:CABG_dstOma48Ma-RTbc98OCFQ_nO+PDmVa0R9ZYiGtACVmRneQ@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>Obviously I've done something wrong but I can't find out
what.<br>
</div>
<div>I also may have misunderstood the meaning of routed network
within libvirt.<br>
</div>
<div>Please give me some advise to solve this problem.<br>
</div>
<div><br>
</div>
<div>Some facts:<br>
The laptop is running Ubuntu 13.04<br>
The net-dumpxml<br>
<a moz-do-not-send="true"
href="https://gist.github.com/kakbit/11103807">https://gist.github.com/kakbit/11103807</a><br>
Routing on laptop<br>
<a moz-do-not-send="true"
href="https://gist.github.com/kakbit/11103832">https://gist.github.com/kakbit/11103832</a>
<br>
</div>
<div>iptables on laptop<br>
<a moz-do-not-send="true"
href="https://gist.github.com/kakbit/11103947">https://gist.github.com/kakbit/11103947</a><br>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
libvirt-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:libvirt-users@redhat.com">libvirt-users@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/libvirt-users">https://www.redhat.com/mailman/listinfo/libvirt-users</a></pre>
</blockquote>
<br>
</body>
</html>