<div dir="ltr">Hi Phil,<div><br></div><div>But you said you disabled firewalld which makes me wonder if you have the necessary forwarding rules active.</div><div><br></div><div>Dan<br><div class="gmail_extra"><br><div class="gmail_quote">On 1 September 2015 at 13:48, Phill Edwards <span dir="ltr"><<a href="mailto:philledwards@gmail.com" target="_blank">philledwards@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi Ajey, I thought I already was doing bridge mode. Below are the network interface definitions from the XML config file for the Sophos VM. (Note that it's actually the middle definition which is connected to the cable modem which is different to how I showed it in the earlier diagram). What I don't understand is that the interface type says "direct" in the XML even though in virt-manager it shows up as "Bridge":<div><br></div><div><img src="cid:ii_14f88f2f886a25c8" alt="Inline image 1" width="353" height="255"><br></div><div><br><div><br></div><div><div> <interface type='bridge'></div><div> <mac address='52:54:00:63:2e:15'/></div><div> <source bridge='br0'/></div><div> <model type='virtio'/></div><div> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/></div><div> </interface></div><div><span style="background-color:rgb(255,255,0)"> <interface type='direct'></span></div><div><span style="background-color:rgb(255,255,0)"> <mac address='00:0c:29:79:d4:e8'/></span></div><div><span style="background-color:rgb(255,255,0)"> <source dev='enp5s0f0' mode='bridge'/></span></div><div><span style="background-color:rgb(255,255,0)"> <model type='virtio'/></span></div><div><span style="background-color:rgb(255,255,0)"> <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/></span></div><div><span style="background-color:rgb(255,255,0)"> </interface></span></div><div> <interface type='direct'></div><div> <mac address='52:54:00:42:33:92'/></div><div> <source dev='enp5s0f1' mode='bridge'/></div><div> <model type='virtio'/></div><div> <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/></div><div> </interface></div></div><div><br></div><div><br></div><div>Regards,</div><div>Phill</div></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Sep 1, 2015 at 10:25 PM, Ajey Gore <span dir="ltr"><<a href="mailto:ajeygore@gmail.com" target="_blank">ajeygore@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <span><div>does you cable modem give you automatically the IP address? if thats the case then you need to do bridge configuration between nic3 and macvtap dhcp ip</div> <div><br></div> <div>and then you will be able to get dhcp attached IP to sophos vm</div></span><div> <br>- ajey<div><br></div> </div> <br><br><div class="gmail_quote"><span><p>On Tue, Sep 1, 2015 at 4:33 PM, Phill Edwards <span dir="ltr"><<a href="mailto:philledwards@gmail.com" target="_blank">philledwards@gmail.com</a>></span> wrote:<br></p></span><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div> <div dir="ltr"><span>Hi, I'm not sure what sort of diagram you mean, but I'll have a try. Does this help? It sounds like I need to do something to enable routing on what I've labelled "NIC3" on the diagram - can you please explain what I need to do?<div><br></div> </span><div> <div><image.png></div> <br></div> <div><br></div> <div>Regards,</div> <div>Phill</div> </div><div><div> <div class="gmail_extra"> <br><div class="gmail_quote">On Tue, Sep 1, 2015 at 4:53 PM, Ajey Gore <span dir="ltr"><<a href="mailto:ajeygore@gmail.com" target="_blank">ajeygore@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <span><div>Can you please drop a rough diagram here? I think you are routing through this VM and must have shared the host interface.</div></span><span><font color="#888888"><div> <br>- ajey<div><br></div> </div></font></span><div><div> <br><br><div class="gmail_quote"> <p>On Tue, Sep 1, 2015 at 7:39 AM, Phill Edwards <span dir="ltr"><<a href="mailto:philledwards@gmail.com" target="_blank">philledwards@gmail.com</a>></span> wrote:<br></p> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div dir="ltr">I'm pretty new to KVM and have a KVM CentOS 7.1 hypervisor running a few VMs. I'm moving all my VMs from an ESXi host as I want to use KVM in future. Most of my VMs are working except for one which is running a Sophos UTM router (Sophos UTM is similar to products like <a href="https://www.pfsense.org/" target="_blank">pfSense</a>, <a href="http://www.smoothwall.org/" target="_blank">Smoothwall</a> etc).<div><br></div> <div>The host has 3 physical NICs which are configured on the Sophos VM as:</div> <div>1) LAN (fixed IP)</div> <div>2) DMZ (fixed IP)</div> <div>3) WAN (which is directly plugged into a cable modem for the internet connection and is configured DHCP). </div> <div><br></div> <div>I have imported the settings from the "old" Sophos machine so I know the configuration of the new one is identical to the old one. I have even tried configuring the NICs to have the same MAC addresses as the old one.</div> <div><br></div> <div> <div>The problem is that no matter what I try I cannot get the WAN NIC to get an internet link up and running with my cable modem. I have re-installed the VM countless times, turned off the modem and VM, done a factory reset of the modem, and, as I mentioned, ensured the MAC addresses are the same. Nothing I try has been successful.</div> <div><br></div> <div>The network interfaces on the new Sophos VM look like this:</div> <div> <span style="color:rgb(0,0,0);font-family:'Courier New'">2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000</span><br style="color:rgb(0,0,0);font-family:'Courier New'"><span style="color:rgb(0,0,0);font-family:'Courier New'">link/ether 00:0c:29:79:d4:de brd ff:ff:ff:ff:ff:ff</span><br style="color:rgb(0,0,0);font-family:'Courier New'"><span style="color:rgb(0,0,0);font-family:'Courier New'">inet <a href="http://192.168.0.254/24" target="_blank">192.168.0.254/24</a> brd 192.168.0.255 scope global eth0</span><br style="color:rgb(0,0,0);font-family:'Courier New'"><span style="color:rgb(0,0,0);font-family:'Courier New'">valid_lft forever preferred_lft forever</span><br style="color:rgb(0,0,0);font-family:'Courier New'"><span style="color:rgb(0,0,0);font-family:'Courier New'">3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1472 qdisc pfifo_fast state UP group default qlen 1000</span><br style="color:rgb(0,0,0);font-family:'Courier New'"><span style="color:rgb(0,0,0);font-family:'Courier New'">link/ether 00:0c:29:79:d4:e8 brd ff:ff:ff:ff:ff:ff</span><br style="color:rgb(0,0,0);font-family:'Courier New'"><span style="color:rgb(0,0,0);font-family:'Courier New'">4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000</span><br style="color:rgb(0,0,0);font-family:'Courier New'"><span style="color:rgb(0,0,0);font-family:'Courier New'">link/ether 00:0c:29:79:d4:f2 brd ff:ff:ff:ff:ff:ff</span><br style="color:rgb(0,0,0);font-family:'Courier New'"><span style="color:rgb(0,0,0);font-family:'Courier New'">inet <a href="http://192.168.1.254/24" target="_blank">192.168.1.254/24</a> brd 192.168.1.255 scope global eth2</span><br style="color:rgb(0,0,0);font-family:'Courier New'"><span style="color:rgb(0,0,0);font-family:'Courier New'">valid_lft forever preferred_lft forever</span><br></div> <div><span style="color:rgb(0,0,0);font-family:'Courier New'"><br></span></div> <div>I also found this in the /var/log/system.log of the Sophos VM:<br></div> <div> <span style="color:rgb(0,0,0);font-family:'Courier New'">2015:08:29-12:04:05 sop dhclient: DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 6</span><br style="color:rgb(0,0,0);font-family:'Courier New'"><span style="color:rgb(0,0,0);font-family:'Courier New'">2015:08:29-12:04:11 sop dhclient: DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 13</span><br style="color:rgb(0,0,0);font-family:'Courier New'"><span style="color:rgb(0,0,0);font-family:'Courier New'">2015:08:29-12:04:24 sop dhclient: DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 2</span><br style="color:rgb(0,0,0);font-family:'Courier New'"><span style="color:rgb(0,0,0);font-family:'Courier New'">2015:08:29-12:04:26 sop dhclient: No DHCPOFFERS received.</span><br></div> <div><br></div> <div>I have shut down firewalld on the KVM host so I don't think there are any firewall rules blocking this. </div> <div><br></div> <div>As soon as I fire up the original Sophos VM on ESXi the internet connection works perfectly again.<br></div> </div> <div><br></div> <div>If I can't get this VM running on KVM it's a show-stopper. Can anyone suggest what might be going on that is preventing the WAN link from connecting? Or suggest a way of troubleshooting this?<br></div> <div><br></div> <div>Thanks in advance.<br></div> </div></div></blockquote> </div> <br></div></div> </blockquote> </div> <br></div> </div></div></div></blockquote></div><br></blockquote></div><br></div> </div></div><br>_______________________________________________<br> libvirt-users mailing list<br> <a href="mailto:libvirt-users@redhat.com">libvirt-users@redhat.com</a><br> <a href="https://www.redhat.com/mailman/listinfo/libvirt-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/libvirt-users</a><br></blockquote></div><br></div></div></div>