7:55 a.m.
Hi,
I just did a fresh F19 x86_64 install on my workstation, copied a
Virtual Machine to it and started the VM (has IP addr 192.168.122.20).
Now I would like to be able to ssh into the VM from another box on my
local LAN like my laptop. Thus far I can't make it work. Steps:
Opened firewall-config
Set the firewall zone of my Ethernet interface to Trusted:
Options -> Change Zone of Connections -> <interface> -> Edit -> General
-> Firewall zone -> Trusted
Click on the reload icon
Set the default zone to Trusted:
Options -> Change Default Zone -> Trusted
Click on the reload icon
Results:
Can not ping VM from laptop:
[patrick@laptop ~]$ ping 192.168.122.20
PING 192.168.122.20 (192.168.122.20) 56(84) bytes of data.
From 10.0.0.135 icmp_seq=1 Destination Port Unreachable
Can not ssh from the laptop to the VM:
[patrick@laptop ~]$ ssh 192.168.122.20
ssh: connect to host 192.168.122.20 port 22: Connection refused
On the workstation IPv4 forwarding is on:
$ cat /proc/sys/net/ipv4/ip_forward
1
So how do I make firewalld allow pings and ssh from remote hosts?
Thanks!
Patrick
3:17 p.m.
Reindl Harald wrote:
Am 24.07.2013 14:55, schrieb Patrick Lists:
> Hi,
>
> I just did a fresh F19 x86_64 install on my workstation, copied a Virtual Machine to
it and started the VM (has IP
> addr 192.168.122.20). Now I would like to be able to ssh into the VM from another box
on my local LAN like my
> laptop. Thus far I can't make it work. Steps:
>
> Opened firewall-config
>
> Set the firewall zone of my Ethernet interface to Trusted:
> Options -> Change Zone of Connections -> <interface> -> Edit ->
General -> Firewall zone -> Trusted
> Click on the reload icon
>
> Set the default zone to Trusted:
> Options -> Change Default Zone -> Trusted
> Click on the reload icon
>
> Results:
> Can not ping VM from laptop:
>
> [patrick@laptop ~]$ ping 192.168.122.20
> PING 192.168.122.20 (192.168.122.20) 56(84) bytes of data.
> From 10.0.0.135 icmp_seq=1 Destination Port Unreachable
>
> Can not ssh from the laptop to the VM:
>
> [patrick@laptop ~]$ ssh 192.168.122.20
> ssh: connect to host 192.168.122.20 port 22: Connection refused
>
> On the workstation IPv4 forwarding is on:
> $ cat /proc/sys/net/ipv4/ip_forward
> 1
>
> So how do I make firewalld allow pings and ssh from remote hosts?
no idea about firewalld, with iptables.service it is easy
however you need iptables-forwarding and masquerade for NAT
* vmnet8 -> virtual interface the VM's are running on
* eth0 -> LAN interface of the host
* 10.0.0.0/24 -> LAN network (host and other machines)
* 192.168.197.0 -> Network with the VMs
iptables -A FORWARD -i eth0 -o vmnet8 -s 10.0.0.0/24 -d 192.168.197.0 -j ACCEPT
iptables -A FORWARD -i vmnet8 -o eth0 -s 192.168.197.0 -d 10.0.0.0/24 -j ACCEPT
iptables -A POSTROUTING -o vmnet8 -t nat -s 10.0.0.0/24 -j MASQUERADE
Several thoughts on this, first this should come after the rule Fedora provides,
to ACCEPT packets ESTABLISHED or RELATED. That means that once the connection is
set up, the first rule will accept the packets, and reduce CPU usage as well as
latency.
The other is less obvious, these rules should be qualified with tests for NEW
connections, so some tricks involving sending in a packet as if it were part of
an existing connection won't work.
So if you add:
-m state --state NEW
to those rules before -j, you will cheaply protect machines beyond the firewall.
Yes, there are some obscure protocols which fail to be set ESTABLISHED,
hopefully these are uncommon enough that if you use them you can put other
qualifiers on the connect. I have run several years without having a legitimate
packet dropped, but logging shows people sending crafted packets which do (and
should) get dropped.
Just the musings of an old paranoid, I like firewalls based on "everything not
explicitly allowed is forbidden." Oh, I drop all protocols except the ones I use
like udp, tcp, and icmp. Amazing what my logs show.
--
Bill Davidsen <davidsen(a)tmr.com>
"We have more to fear from the bungling of the incompetent than from
the machinations of the wicked." - from Slashdot
3:46 p.m.
Anthony Messina wrote:
On Wednesday, July 24, 2013 02:55:56 PM Patrick Lists wrote:
> [patrick@laptop ~]$ ping 192.168.122.20
> PING 192.168.122.20 (192.168.122.20) 56(84) bytes of data.
> From 10.0.0.135 icmp_seq=1 Destination Port Unreachable
>
> Can not ssh from the laptop to the VM:
>
> [patrick@laptop ~]$ ssh 192.168.122.20
> ssh: connect to host 192.168.122.20 port 22: Connection refused
To access the VM "through" the host system without using bridged networking,
it seems like you'd need to forward port 22 from the host's IP address to the
VM's IP address via. You may or may not want to do this for port 22, as you'd
then bypass the ability to access port 22 on the host machine (since it would
be forwarded to the VM).
The bridged network works wonders to solve this issue:
http://wiki.libvirt.org/page/Networking#Host_configuration_2
If you have another IP available, you can bind that to the same NIC and use
iptables to forward the connection.
iptables -p tcp -d 288.41.42.43 --dport ssh -j DNAT 10.40.51.22
or use a non-standard port and send it to the ssh port on the VM. That allows
running a stock sshd on the VM.
I have a script in my firewall rules, which defines a bash function to do all
the stuff, then a one liner with parameters to do the setup. You can even do
some (very) crude load leveling by putting multiple machines on the DNAT rule.
--
Bill Davidsen <davidsen(a)tmr.com>
"We have more to fear from the bungling of the incompetent than from
the machinations of the wicked." - from Slashdot
3:29 p.m.
Darryl L. Pierce wrote:
On Thu, Jul 25, 2013 at 05:25:29AM +0800, Ed Greshko wrote:
> On 07/24/13 22:38, Patrick Lists wrote:
>> With the Firewalld service stopped I can ping and ssh fine into the VM from my
laptop.
>
> FWIW, it has been a long time but I always had FW trouble when dealing with a NAT
configuration.
>
> I don't know virt-manager, but if possible I'd switch to a bridged network
> configuration so the VM has a 10.X.X.X IP.
I'd only do that if you absolutely need to access the VM from the
outside, or at least outside of the host machine.
Your caution is correct, but in many cases sites run web servers, mail, DNS,
DHCP,and other services on a VM. A bridge is not the only way to do that, but it
is one approach.
--
Bill Davidsen <davidsen(a)tmr.com>
"We have more to fear from the bungling of the incompetent than from
the machinations of the wicked." - from Slashdot
12:44 a.m.
On 07/24/2013 05:55 AM, Patrick Lists wrote:
I just did a fresh F19 x86_64 install on my workstation, copied a
Virtual Machine to it and started the VM (has IP addr 192.168.122.20).
Now I would like to be able to ssh into the VM from another box on my
local LAN like my laptop. Thus far I can't make it work. Steps:
So how do I make firewalld allow pings and ssh from remote hosts?
For the archive:
In Fedora's default configuration, there is one virtual network for
hosts in a NAT configuration. In that configuration, you cannot achieve
what you asked. There's no way to allow PING to the internal hosts.
You *can* allow SSH, but only by forwarding specific ports.
There are other supported network configurations for libvirt. In
addition to NAT networks, you can have routed or bridged networks:
http://wiki.libvirt.org/page/VirtualNetworking#Examples_of_common_scenarios
In a routed network, the firewall configuration should be pretty
straightforward, but you'd need to add a route to the guest network at
every remote host, or at the router that they share.
In a bridged network, guests are on the same LAN as the host and
normally aren't subject to the host's firewall rules:
https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Lin...
Bridged networking is the most straightforward configuration if you want
remote access to your guests.
3:24 p.m.
Am 25.07.2013 22:17, schrieb Bill Davidsen:
Reindl Harald wrote:
>> On the workstation IPv4 forwarding is on:
>> $ cat /proc/sys/net/ipv4/ip_forward
>> 1
>>
>> So how do I make firewalld allow pings and ssh from remote hosts?
>
> no idea about firewalld, with iptables.service it is easy
> however you need iptables-forwarding and masquerade for NAT
>
> * vmnet8 -> virtual interface the VM's are running on
> * eth0 -> LAN interface of the host
> * 10.0.0.0/24 -> LAN network (host and other machines)
> * 192.168.197.0 -> Network with the VMs
>
> iptables -A FORWARD -i eth0 -o vmnet8 -s 10.0.0.0/24 -d 192.168.197.0 -j ACCEPT
> iptables -A FORWARD -i vmnet8 -o eth0 -s 192.168.197.0 -d 10.0.0.0/24 -j ACCEPT
> iptables -A POSTROUTING -o vmnet8 -t nat -s 10.0.0.0/24 -j MASQUERADE
>
Several thoughts on this, first this should come after the rule Fedora provides, to
ACCEPT packets ESTABLISHED or
RELATED. That means that once the connection is set up, the first rule will accept the
packets, and reduce CPU
usage as well as latency.
that's a different thing and if i come up here with my 548 line iptables-script
resulting in 1318 lines i would hardly have helped someone :-)
[root@srv-rhsoft:~]$ cat /scripts/iptables.sh | wc -l
548
[root@srv-rhsoft:~]$ /usr/sbin/iptables --list --numeric --verbose | grep -v LOG | wc -l
1318
The other is less obvious, these rules should be qualified with tests
for NEW connections, so some tricks involving
sending in a packet as if it were part of an existing connection won't work.
So if you add:
-m state --state NEW
to those rules before -j, you will cheaply protect machines beyond the firewall. Yes,
there are some obscure
protocols which fail to be set ESTABLISHED, hopefully these are uncommon enough that if
you use them you can put
other qualifiers on the connect
uhm no - the intention of my example was to make the machines behind the virtual NAT
accesable the same way as they would be physical machines on the same network
that you can add source / target / port / multiport-specific rules is a different
topic, my intention was to show how forwarding/masquerading between different NAT's
works and assuming that the VM network is inside a LAN the above would be OK
if you need to access the guests from the internet you need to specify ports
and single addresses to be on the safe side anyways
7:23 a.m.
On 07/26/2013 04:59 AM, poma wrote:
> Here[1] are some picturesque examples to help you better
understand the
> topology of the virtual network. :)
…
> [1] http://wiki.libvirt.org/page/VirtualNetworking
http://goo.gl/Bkup0X
Thanks poma. Those pics are most useful.
Regards,
Patrick
9:59 p.m.
…
>>> So how do I make firewalld allow pings and ssh from
remote hosts?
…
>> exo-open --launch WebBrowser $(rpm -qi firewalld | grep URL |
awk
>> '{print $3}')
…
Here[1] are some picturesque examples to help you better understand
the
topology of the virtual network. :)
…
http://goo.gl/Bkup0X
poma
4:05 p.m.
On 07/25/2013 10:46 PM, Bill Davidsen wrote:
[snip]
> The bridged network works wonders to solve this issue:
> http://wiki.libvirt.org/page/Networking#Host_configuration_2
>
If you have another IP available, you can bind that to the same NIC and
use iptables to forward the connection.
iptables -p tcp -d 288.41.42.43 --dport ssh -j DNAT 10.40.51.22
or use a non-standard port and send it to the ssh port on the VM. That
allows running a stock sshd on the VM.
I have a script in my firewall rules, which defines a bash function to
do all the stuff, then a one liner with parameters to do the setup. You
can even do some (very) crude load leveling by putting multiple machines
on the DNAT rule.
Thanks for the solution Bill. These VMs are not exposed to the Big Bad
Internet. I decided to go with a bridge and after a bit of digging it's
working fine now. The VMs all have SELinux in enforcing mode, their
firewalls enabled and ssh access only via public key authentication.
Regards,
Patrick
9:20 a.m.
On 07/25/2013 02:50 PM, Darryl L. Pierce wrote:
[snip]
The easiest way is to go into Virtual Machine Manager on the host
os,
edit the Default network interface and have it bridged on one of your
physical network devices. That way any VM that uses the Default network
interface will be bridged.
Thanks for the tip. I've got it working now in bridged mode and even
firewalld is playing along nicely.
Regards,
Patrick
9:18 a.m.
On 07/25/2013 01:34 AM, Ed Greshko wrote:
On 07/25/13 06:56, Patrick Lists wrote:
> On 07/25/2013 12:52 AM, Ed Greshko wrote:
>>
>> Oh.... ssh is enabled, along with mdns and dhcpV6-client, by default....at least
on all the F19 installs I've done.
>
> Yes I have seen those enabled in various Firewalld zones yet I still get:
>
> [patrick@laptop ~]$ ssh 192.168.122.20
> ssh: connect to host 192.168.122.20 port 22: Connection refused
>
That message kind of confuses me.....
Consistently, with the port disabled I get....
[egreshko@meimei ~]$ ssh 192.168.0.186
ssh: connect to host 192.168.0.186 port 22: No route to host
Only with the port enabled but sshd not running do I get....
[egreshko@meimei ~]$ ssh 192.168.0.186
ssh: connect to host 192.168.0.186 port 22: Connection refused
Which is why I wonder if NAT isn't the issue.
I have switched to a bridged setup so I'll probably never know. Thank
you for your suggestions.
Regards,
Patrick
7:50 a.m.
On Wed, Jul 24, 2013 at 11:44:56PM +0200, Patrick Lists wrote:
On 07/24/2013 11:25 PM, Ed Greshko wrote:
>On 07/24/13 22:38, Patrick Lists wrote:
>>With the Firewalld service stopped I can ping and ssh fine into the VM from my
laptop.
>
>FWIW, it has been a long time but I always had FW trouble when dealing with a NAT
configuration.
>
>I don't know virt-manager, but if possible I'd switch to a bridged network
configuration so the VM has a 10.X.X.X IP.
Yup agree. I am already investigating how I can best change the
default libvirt setup to a bridged one. Live is too short to have to
mess with NAT and the latest shiny firewall thingy ;-) Still, it
would be nice to understand how to make ssh work with firewalld so
if anyone has a suggestion...
The easiest way is to go into Virtual Machine Manager on the host os,
edit the Default network interface and have it bridged on one of your
physical network devices. That way any VM that uses the Default network
interface will be bridged.
--
Darryl L. Pierce <mcpierce(a)gmail.com>
http://mcpierce.fedorapeople.org/
"What do you care what people think, Mr. Feynman?"
7:48 a.m.
On Thu, Jul 25, 2013 at 05:25:29AM +0800, Ed Greshko wrote:
On 07/24/13 22:38, Patrick Lists wrote:
> With the Firewalld service stopped I can ping and ssh fine into the VM from my
laptop.
FWIW, it has been a long time but I always had FW trouble when dealing with a NAT
configuration.
I don't know virt-manager, but if possible I'd switch to a bridged network
configuration so the VM has a 10.X.X.X IP.
I'd only do that if you absolutely need to access the VM from the
outside, or at least outside of the host machine.
--
Darryl L. Pierce <mcpierce(a)gmail.com>
http://mcpierce.fedorapeople.org/
"What do you care what people think, Mr. Feynman?"
6:12 p.m.
On Wednesday, July 24, 2013 06:06:49 PM Anthony Messina wrote:
VM's IP address via. You may or may not want to do this for port
22, as
That should be "VM's IP address via iptables."
--
Anthony - http://messinet.com - http://messinet.com/~amessina/gallery
8F89 5E72 8DF0 BCF0 10BE 9967 92DC 35DC B001 4A4E
6:34 p.m.
On 07/25/13 06:56, Patrick Lists wrote:
On 07/25/2013 12:52 AM, Ed Greshko wrote:
>
> Oh.... ssh is enabled, along with mdns and dhcpV6-client, by default....at least on
all the F19 installs I've done.
Yes I have seen those enabled in various Firewalld zones yet I still get:
[patrick@laptop ~]$ ssh 192.168.122.20
ssh: connect to host 192.168.122.20 port 22: Connection refused
That message kind of confuses me.....
Consistently, with the port disabled I get....
[egreshko@meimei ~]$ ssh 192.168.0.186
ssh: connect to host 192.168.0.186 port 22: No route to host
Only with the port enabled but sshd not running do I get....
[egreshko@meimei ~]$ ssh 192.168.0.186
ssh: connect to host 192.168.0.186 port 22: Connection refused
Which is why I wonder if NAT isn't the issue.
--
Getting tired of non-Fedora discussions and self-serving posts
6:06 p.m.
On Wednesday, July 24, 2013 02:55:56 PM Patrick Lists wrote:
[patrick@laptop ~]$ ping 192.168.122.20
PING 192.168.122.20 (192.168.122.20) 56(84) bytes of data.
From 10.0.0.135 icmp_seq=1 Destination Port Unreachable
Can not ssh from the laptop to the VM:
[patrick@laptop ~]$ ssh 192.168.122.20
ssh: connect to host 192.168.122.20 port 22: Connection refused
To access the VM "through" the host system without using bridged networking,
it seems like you'd need to forward port 22 from the host's IP address to the
VM's IP address via. You may or may not want to do this for port 22, as you'd
then bypass the ability to access port 22 on the host machine (since it would
be forwarded to the VM).
The bridged network works wonders to solve this issue:
http://wiki.libvirt.org/page/Networking#Host_configuration_2
-A
--
Anthony - http://messinet.com - http://messinet.com/~amessina/gallery
8F89 5E72 8DF0 BCF0 10BE 9967 92DC 35DC B001 4A4E
5:56 p.m.
On 07/25/2013 12:52 AM, Ed Greshko wrote:
On 07/25/13 05:44, Patrick Lists wrote:
> On 07/24/2013 11:25 PM, Ed Greshko wrote:
>> On 07/24/13 22:38, Patrick Lists wrote:
>>> With the Firewalld service stopped I can ping and ssh fine into the VM from
my laptop.
>>
>> FWIW, it has been a long time but I always had FW trouble when dealing with a NAT
configuration.
>>
>> I don't know virt-manager, but if possible I'd switch to a bridged
network configuration so the VM has a 10.X.X.X IP.
>
> Yup agree. I am already investigating how I can best change the default libvirt setup
to a bridged one. Live is too short to have to mess with NAT and the latest shiny firewall
thingy ;-) Still, it would be nice to understand how to make ssh work with firewalld so if
anyone has a suggestion...
>
Oh.... ssh is enabled, along with mdns and dhcpV6-client, by default....at least on all
the F19 installs I've done.
Yes I have seen those enabled in various Firewalld zones yet I still get:
[patrick@laptop ~]$ ssh 192.168.122.20
ssh: connect to host 192.168.122.20 port 22: Connection refused
Regards,
Patrick
5:52 p.m.
On 07/25/13 05:44, Patrick Lists wrote:
On 07/24/2013 11:25 PM, Ed Greshko wrote:
> On 07/24/13 22:38, Patrick Lists wrote:
>> With the Firewalld service stopped I can ping and ssh fine into the VM from my
laptop.
>
> FWIW, it has been a long time but I always had FW trouble when dealing with a NAT
configuration.
>
> I don't know virt-manager, but if possible I'd switch to a bridged network
configuration so the VM has a 10.X.X.X IP.
Yup agree. I am already investigating how I can best change the default libvirt setup to
a bridged one. Live is too short to have to mess with NAT and the latest shiny firewall
thingy ;-) Still, it would be nice to understand how to make ssh work with firewalld so if
anyone has a suggestion...
Oh.... ssh is enabled, along with mdns and dhcpV6-client, by default....at least on all
the F19 installs I've done.
--
Getting tired of non-Fedora discussions and self-serving posts
5:06 p.m.
On 24.07.2013 19:01, Patrick Lists wrote:
On 07/24/2013 06:39 PM, poma wrote:
> On 24.07.2013 14:55, Patrick Lists wrote:
> …
>> So how do I make firewalld allow pings and ssh from remote hosts?
>>
>> Thanks!
>> Patrick
>
> exo-open --launch WebBrowser $(rpm -qi firewalld | grep URL | awk
> '{print $3}')
For those without the Xfce desktop (exo is an Xfce app lib), the output
is: http://fedorahosted.org/firewalld.
Thanks for the RTFM poma but I have already browsed through the docs at
https://fedoraproject.org/wiki/FirewallD/ and it did not provide me with
a clue. Maybe I overlooked something. If you have any idea how to fix
this I would appreciate a hint where on that page I can find the solution.
Regards,
Patrick
Here[1] are some picturesque examples to help you better understand the
topology of the virtual network. :)
poma
[1] http://wiki.libvirt.org/page/VirtualNetworking
4:44 p.m.
On 07/24/2013 11:25 PM, Ed Greshko wrote:
On 07/24/13 22:38, Patrick Lists wrote:
> With the Firewalld service stopped I can ping and ssh fine into the VM from my
laptop.
FWIW, it has been a long time but I always had FW trouble when dealing with a NAT
configuration.
I don't know virt-manager, but if possible I'd switch to a bridged network
configuration so the VM has a 10.X.X.X IP.
Yup agree. I am already investigating how I can best change the default
libvirt setup to a bridged one. Live is too short to have to mess with
NAT and the latest shiny firewall thingy ;-) Still, it would be nice to
understand how to make ssh work with firewalld so if anyone has a
suggestion...
Regards,
Patrick
4:25 p.m.
On 07/24/13 22:38, Patrick Lists wrote:
With the Firewalld service stopped I can ping and ssh fine into the
VM from my laptop.
FWIW, it has been a long time but I always had FW trouble when dealing with a NAT
configuration.
I don't know virt-manager, but if possible I'd switch to a bridged network
configuration so the VM has a 10.X.X.X IP.
--
Getting tired of non-Fedora discussions and self-serving posts
3:45 p.m.
Darryl L. Pierce wrote:
On Wed, Jul 24, 2013 at 02:55:56PM +0200, Patrick Lists wrote:
> Hi,
>
> I just did a fresh F19 x86_64 install on my workstation, copied a
> Virtual Machine to it and started the VM (has IP addr
> 192.168.122.20). Now I would like to be able to ssh into the VM from
> another box on my local LAN like my laptop. Thus far I can't make it
> work. Steps:
>
> Opened firewall-config
>
> Set the firewall zone of my Ethernet interface to Trusted:
> Options -> Change Zone of Connections -> <interface> -> Edit ->
> General -> Firewall zone -> Trusted
> Click on the reload icon
>
> Set the default zone to Trusted:
> Options -> Change Default Zone -> Trusted
> Click on the reload icon
>
> Results:
> Can not ping VM from laptop:
>
> [patrick@laptop ~]$ ping 192.168.122.20
> PING 192.168.122.20 (192.168.122.20) 56(84) bytes of data.
> From 10.0.0.135 icmp_seq=1 Destination Port Unreachable
>
> Can not ssh from the laptop to the VM:
>
> [patrick@laptop ~]$ ssh 192.168.122.20
> ssh: connect to host 192.168.122.20 port 22: Connection refused
>
> On the workstation IPv4 forwarding is on:
> $ cat /proc/sys/net/ipv4/ip_forward
> 1
>
> So how do I make firewalld allow pings and ssh from remote hosts?
So I'll be honest: I originally uninstalled firewalld because (at the
time) I didn't want to mess with learning to set it up. :D
I installed it today and played around with it and have a question for
you: were you editing the "Runtime" or the "Permanent" configuration?
If
you were editing runtime and then hit reload then you overwrote your
changes with the permanent config which you didn't modify.
Yes, I found that when I was first using firewalld, I kept looking for a button
or menu item like "install my changes." And it might be a good thing not to make
changes active until all changes have been entered. It's a user interface issue,
for the moment I don't use it for tricky stuff, but it works well for typical
cases. I'm not sure it's really easier to use than iptables rules, but choices
are good.
--
Bill Davidsen <davidsen(a)tmr.com>
"We have more to fear from the bungling of the incompetent than from
the machinations of the wicked." - from Slashdot
12:01 p.m.
On 07/24/2013 06:39 PM, poma wrote:
On 24.07.2013 14:55, Patrick Lists wrote:
…
> So how do I make firewalld allow pings and ssh from remote hosts?
>
> Thanks!
> Patrick
exo-open --launch WebBrowser $(rpm -qi firewalld | grep URL | awk
'{print $3}')
For those without the Xfce desktop (exo is an Xfce app lib), the output
is: http://fedorahosted.org/firewalld.
Thanks for the RTFM poma but I have already browsed through the docs at
https://fedoraproject.org/wiki/FirewallD/ and it did not provide me with
a clue. Maybe I overlooked something. If you have any idea how to fix
this I would appreciate a hint where on that page I can find the solution.
Regards,
Patrick
9:38 a.m.
On 07/24/2013 04:12 PM, Darryl L. Pierce wrote:
On Wed, Jul 24, 2013 at 02:55:56PM +0200, Patrick Lists wrote:
> Hi,
>
> I just did a fresh F19 x86_64 install on my workstation, copied a
> Virtual Machine to it and started the VM (has IP addr
> 192.168.122.20). Now I would like to be able to ssh into the VM from
> another box on my local LAN like my laptop. Thus far I can't make it
> work. Steps:
>
> Opened firewall-config
>
> Set the firewall zone of my Ethernet interface to Trusted:
> Options -> Change Zone of Connections -> <interface> -> Edit ->
> General -> Firewall zone -> Trusted
> Click on the reload icon
>
> Set the default zone to Trusted:
> Options -> Change Default Zone -> Trusted
> Click on the reload icon
>
> Results:
> Can not ping VM from laptop:
>
> [patrick@laptop ~]$ ping 192.168.122.20
> PING 192.168.122.20 (192.168.122.20) 56(84) bytes of data.
> From 10.0.0.135 icmp_seq=1 Destination Port Unreachable
>
> Can not ssh from the laptop to the VM:
>
> [patrick@laptop ~]$ ssh 192.168.122.20
> ssh: connect to host 192.168.122.20 port 22: Connection refused
>
> On the workstation IPv4 forwarding is on:
> $ cat /proc/sys/net/ipv4/ip_forward
> 1
>
> So how do I make firewalld allow pings and ssh from remote hosts?
So I'll be honest: I originally uninstalled firewalld because (at the
time) I didn't want to mess with learning to set it up. :D
I installed it today and played around with it and have a question for
you: were you editing the "Runtime" or the "Permanent" configuration?
If
you were editing runtime and then hit reload then you overwrote your
changes with the permanent config which you didn't modify.
Good point. I noticed that too. But when the Zone is "Trusted" you can
not change anything (neither in Runtime Configuration or Permanent
Configuration). To try something else I changed the Default Zone and
Zone of Connections to 'Home' and now I can ping the VM (192.168.120.22)
from my laptop. But I still get 'ssh: connect to host 192.168.122.20
port 22: Connection refused' when trying to ssh from my laptop to the VM.
With the Firewalld service stopped I can ping and ssh fine into the VM
from my laptop.
Regards,
Patrick
9:30 a.m.
On 07/24/2013 04:21 PM, Ed Greshko wrote:
On 07/24/13 20:55, Patrick Lists wrote:
> Hi,
>
> I just did a fresh F19 x86_64 install on my workstation, copied a Virtual Machine to
it and started the VM (has IP addr 192.168.122.20). Now I would like to be able to ssh
into the VM from another box on my local LAN like my laptop. Thus far I can't make it
work. Steps:
>
> Opened firewall-config
>
> Set the firewall zone of my Ethernet interface to Trusted:
> Options -> Change Zone of Connections -> <interface> -> Edit ->
General -> Firewall zone -> Trusted
> Click on the reload icon
>
> Set the default zone to Trusted:
> Options -> Change Default Zone -> Trusted
> Click on the reload icon
>
> Results:
> Can not ping VM from laptop:
>
> [patrick@laptop ~]$ ping 192.168.122.20
> PING 192.168.122.20 (192.168.122.20) 56(84) bytes of data.
> From 10.0.0.135 icmp_seq=1 Destination Port Unreachable
>
> Can not ssh from the laptop to the VM:
>
> [patrick@laptop ~]$ ssh 192.168.122.20
> ssh: connect to host 192.168.122.20 port 22: Connection refused
>
> On the workstation IPv4 forwarding is on:
> $ cat /proc/sys/net/ipv4/ip_forward
> 1
>
> So how do I make firewalld allow pings and ssh from remote hosts?
>
Looking at the above leads me to several questions......
What has the IP address of 10.0.0.135?
That's the IP address of the workstation with the fresh F19 install.
What type of VM are we talking about?
The VM is a CentOS 6 x86_64 installation with ssh service enabled,
running and port 22 opened in iptables.
Is the VM network interface defined as NAT or Host Only?
Its' NAT. In virt-manager the VM's hardware details say:
Source device: Virtual Network 'default': NAT
Device Model: virtio
FWIW: when I stop firewalld I can ping and ssh the VM fine.
FWIW, I find that with VirtualBox things go more smoothly with
respect to external connections if the network interface of the VM is "bridged"
to the host.
Glad to hear it works for you. I'm not too keen on anything Oracle and
having to install additional stuff so I'll stick with Fedora's
Virtualization.
Regards,
Patrick
9:21 a.m.
On 07/24/13 20:55, Patrick Lists wrote:
Hi,
I just did a fresh F19 x86_64 install on my workstation, copied a Virtual Machine to it
and started the VM (has IP addr 192.168.122.20). Now I would like to be able to ssh into
the VM from another box on my local LAN like my laptop. Thus far I can't make it work.
Steps:
Opened firewall-config
Set the firewall zone of my Ethernet interface to Trusted:
Options -> Change Zone of Connections -> <interface> -> Edit -> General
-> Firewall zone -> Trusted
Click on the reload icon
Set the default zone to Trusted:
Options -> Change Default Zone -> Trusted
Click on the reload icon
Results:
Can not ping VM from laptop:
[patrick@laptop ~]$ ping 192.168.122.20
PING 192.168.122.20 (192.168.122.20) 56(84) bytes of data.
From 10.0.0.135 icmp_seq=1 Destination Port Unreachable
Can not ssh from the laptop to the VM:
[patrick@laptop ~]$ ssh 192.168.122.20
ssh: connect to host 192.168.122.20 port 22: Connection refused
On the workstation IPv4 forwarding is on:
$ cat /proc/sys/net/ipv4/ip_forward
1
So how do I make firewalld allow pings and ssh from remote hosts?
Looking at the above leads me to several questions......
What has the IP address of 10.0.0.135?
What type of VM are we talking about?
Is the VM network interface defined as NAT or Host Only?
FWIW, I find that with VirtualBox things go more smoothly with respect to external
connections if the network interface of the VM is "bridged" to the host.
--
Getting tired of non-Fedora discussions and self-serving posts
9:12 a.m.
On Wed, Jul 24, 2013 at 02:55:56PM +0200, Patrick Lists wrote:
Hi,
I just did a fresh F19 x86_64 install on my workstation, copied a
Virtual Machine to it and started the VM (has IP addr
192.168.122.20). Now I would like to be able to ssh into the VM from
another box on my local LAN like my laptop. Thus far I can't make it
work. Steps:
Opened firewall-config
Set the firewall zone of my Ethernet interface to Trusted:
Options -> Change Zone of Connections -> <interface> -> Edit ->
General -> Firewall zone -> Trusted
Click on the reload icon
Set the default zone to Trusted:
Options -> Change Default Zone -> Trusted
Click on the reload icon
Results:
Can not ping VM from laptop:
[patrick@laptop ~]$ ping 192.168.122.20
PING 192.168.122.20 (192.168.122.20) 56(84) bytes of data.
From 10.0.0.135 icmp_seq=1 Destination Port Unreachable
Can not ssh from the laptop to the VM:
[patrick@laptop ~]$ ssh 192.168.122.20
ssh: connect to host 192.168.122.20 port 22: Connection refused
On the workstation IPv4 forwarding is on:
$ cat /proc/sys/net/ipv4/ip_forward
1
So how do I make firewalld allow pings and ssh from remote hosts?
So I'll be honest: I originally uninstalled firewalld because (at the
time) I didn't want to mess with learning to set it up. :D
I installed it today and played around with it and have a question for
you: were you editing the "Runtime" or the "Permanent" configuration?
If
you were editing runtime and then hit reload then you overwrote your
changes with the permanent config which you didn't modify.
--
Darryl L. Pierce <mcpierce(a)gmail.com>
http://mcpierce.fedorapeople.org/
"What do you care what people think, Mr. Feynman?"
8:05 a.m.
Am 24.07.2013 14:55, schrieb Patrick Lists:
Hi,
I just did a fresh F19 x86_64 install on my workstation, copied a Virtual Machine to it
and started the VM (has IP
addr 192.168.122.20). Now I would like to be able to ssh into the VM from another box on
my local LAN like my
laptop. Thus far I can't make it work. Steps:
Opened firewall-config
Set the firewall zone of my Ethernet interface to Trusted:
Options -> Change Zone of Connections -> <interface> -> Edit -> General
-> Firewall zone -> Trusted
Click on the reload icon
Set the default zone to Trusted:
Options -> Change Default Zone -> Trusted
Click on the reload icon
Results:
Can not ping VM from laptop:
[patrick@laptop ~]$ ping 192.168.122.20
PING 192.168.122.20 (192.168.122.20) 56(84) bytes of data.
From 10.0.0.135 icmp_seq=1 Destination Port Unreachable
Can not ssh from the laptop to the VM:
[patrick@laptop ~]$ ssh 192.168.122.20
ssh: connect to host 192.168.122.20 port 22: Connection refused
On the workstation IPv4 forwarding is on:
$ cat /proc/sys/net/ipv4/ip_forward
1
So how do I make firewalld allow pings and ssh from remote hosts?
no idea about firewalld, with iptables.service it is easy
however you need iptables-forwarding and masquerade for NAT
* vmnet8 -> virtual interface the VM's are running on
* eth0 -> LAN interface of the host
* 10.0.0.0/24 -> LAN network (host and other machines)
* 192.168.197.0 -> Network with the VMs
iptables -A FORWARD -i eth0 -o vmnet8 -s 10.0.0.0/24 -d 192.168.197.0 -j ACCEPT
iptables -A FORWARD -i vmnet8 -o eth0 -s 192.168.197.0 -d 10.0.0.0/24 -j ACCEPT
iptables -A POSTROUTING -o vmnet8 -t nat -s 10.0.0.0/24 -j MASQUERADE
3921
days inactive
3929
days old
28 comments
8 participants
participants (8)
-
Anthony Joseph Messina -
Bill Davidsen -
Darryl L. Pierce -
Ed Greshko -
Gordon Messmer -
Patrick Lists -
poma -
Reindl Harald