qemu guest is bypassing host's firewall
Clash Royale CLAN TAG#URR8PPP
up vote
1
down vote
favorite
I've got a Ubuntu host running several virtual machines using qemu-kvm.
Every guest should use our local DNS server, so I blocked outgoing DNS requests using ufw on the host machine:
sudo ufw deny out dns
It's working on the host fine and something like this won't work:
dig stackexchange.com @8.8.4.4
However from guests, everyone can use any DNS servers they like. Actually I can see the packets going through the host to 8.8.4.4 without being blocked by host and the response being received by the guests.
The guests are using NAT as their network configuration, and I'm wondering is this how NAT works or I'm missing something else here?
dns virtual-machine firewall qemu nat
asked Aug 28 at 17:16
Ravexina
962719
add a comment |Â
up vote
1
down vote
favorite
I've got a Ubuntu host running several virtual machines using qemu-kvm.
Every guest should use our local DNS server, so I blocked outgoing DNS requests using ufw on the host machine:
sudo ufw deny out dns
It's working on the host fine and something like this won't work:
dig stackexchange.com @8.8.4.4
However from guests, everyone can use any DNS servers they like. Actually I can see the packets going through the host to 8.8.4.4 without being blocked by host and the response being received by the guests.
The guests are using NAT as their network configuration, and I'm wondering is this how NAT works or I'm missing something else here?
dns virtual-machine firewall qemu nat
asked Aug 28 at 17:16
Ravexina
962719
2
ufw denyapplies only to locally originating or terminating traffic, not forwarded traffic such as to your VMs. You probably need a different firewall manager, other thanufw. You also should be using virt-manager instead of manually creating VMs. Libvirt has its own network filter which can block such traffic.
– Michael Hampton
Aug 28 at 19:16
1
Depending on how you configured networking with with qemu-kvm, packets may or may not get forwarded by the host, and if they are not forwarded, they won't go through the iptables FORWARD chain and can't be filtered. So make sure you get a tun/tap interface in the host for each VM, setup the host to forward packets (and masquerade if necessary), and then you can add the correct filtering rules (withiptablesifufwcan't do that).
– dirkt
Aug 29 at 5:42
add a comment |Â
up vote
1
down vote
favorite
up vote
1
down vote
favorite
I've got a Ubuntu host running several virtual machines using qemu-kvm.
Every guest should use our local DNS server, so I blocked outgoing DNS requests using ufw on the host machine:
sudo ufw deny out dns
It's working on the host fine and something like this won't work:
dig stackexchange.com @8.8.4.4
However from guests, everyone can use any DNS servers they like. Actually I can see the packets going through the host to 8.8.4.4 without being blocked by host and the response being received by the guests.
The guests are using NAT as their network configuration, and I'm wondering is this how NAT works or I'm missing something else here?
dns virtual-machine firewall qemu nat
asked Aug 28 at 17:16
Ravexina
962719
I've got a Ubuntu host running several virtual machines using qemu-kvm.
Every guest should use our local DNS server, so I blocked outgoing DNS requests using ufw on the host machine:
sudo ufw deny out dns
It's working on the host fine and something like this won't work:
dig stackexchange.com @8.8.4.4
However from guests, everyone can use any DNS servers they like. Actually I can see the packets going through the host to 8.8.4.4 without being blocked by host and the response being received by the guests.
The guests are using NAT as their network configuration, and I'm wondering is this how NAT works or I'm missing something else here?
dns virtual-machine firewall qemu nat
dns virtual-machine firewall qemu nat
asked Aug 28 at 17:16
Ravexina
962719
asked Aug 28 at 17:16
Ravexina
962719
asked Aug 28 at 17:16
Ravexina
962719
asked Aug 28 at 17:16
Ravexina
962719
asked Aug 28 at 17:16
Ravexina
962719
962719
2
ufw denyapplies only to locally originating or terminating traffic, not forwarded traffic such as to your VMs. You probably need a different firewall manager, other thanufw. You also should be using virt-manager instead of manually creating VMs. Libvirt has its own network filter which can block such traffic.
– Michael Hampton
Aug 28 at 19:16
1
Depending on how you configured networking with with qemu-kvm, packets may or may not get forwarded by the host, and if they are not forwarded, they won't go through the iptables FORWARD chain and can't be filtered. So make sure you get a tun/tap interface in the host for each VM, setup the host to forward packets (and masquerade if necessary), and then you can add the correct filtering rules (withiptablesifufwcan't do that).
– dirkt
Aug 29 at 5:42
add a comment |Â
2
ufw denyapplies only to locally originating or terminating traffic, not forwarded traffic such as to your VMs. You probably need a different firewall manager, other thanufw. You also should be using virt-manager instead of manually creating VMs. Libvirt has its own network filter which can block such traffic.
– Michael Hampton
Aug 28 at 19:16
1
Depending on how you configured networking with with qemu-kvm, packets may or may not get forwarded by the host, and if they are not forwarded, they won't go through the iptables FORWARD chain and can't be filtered. So make sure you get a tun/tap interface in the host for each VM, setup the host to forward packets (and masquerade if necessary), and then you can add the correct filtering rules (withiptablesifufwcan't do that).
– dirkt
Aug 29 at 5:42
2
2
ufw deny applies only to locally originating or terminating traffic, not forwarded traffic such as to your VMs. You probably need a different firewall manager, other than ufw. You also should be using virt-manager instead of manually creating VMs. Libvirt has its own network filter which can block such traffic.– Michael Hampton
Aug 28 at 19:16
ufw deny applies only to locally originating or terminating traffic, not forwarded traffic such as to your VMs. You probably need a different firewall manager, other than ufw. You also should be using virt-manager instead of manually creating VMs. Libvirt has its own network filter which can block such traffic.– Michael Hampton
Aug 28 at 19:16
1
1
Depending on how you configured networking with with qemu-kvm, packets may or may not get forwarded by the host, and if they are not forwarded, they won't go through the iptables FORWARD chain and can't be filtered. So make sure you get a tun/tap interface in the host for each VM, setup the host to forward packets (and masquerade if necessary), and then you can add the correct filtering rules (with
iptables if ufw can't do that).– dirkt
Aug 29 at 5:42
Depending on how you configured networking with with qemu-kvm, packets may or may not get forwarded by the host, and if they are not forwarded, they won't go through the iptables FORWARD chain and can't be filtered. So make sure you get a tun/tap interface in the host for each VM, setup the host to forward packets (and masquerade if necessary), and then you can add the correct filtering rules (with
iptables if ufw can't do that).– dirkt
Aug 29 at 5:42
add a comment |Â
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f465350%2fqemu-guest-is-bypassing-hosts-firewall%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
2
ufw denyapplies only to locally originating or terminating traffic, not forwarded traffic such as to your VMs. You probably need a different firewall manager, other thanufw. You also should be using virt-manager instead of manually creating VMs. Libvirt has its own network filter which can block such traffic.– Michael Hampton
Aug 28 at 19:16
1
Depending on how you configured networking with with qemu-kvm, packets may or may not get forwarded by the host, and if they are not forwarded, they won't go through the iptables FORWARD chain and can't be filtered. So make sure you get a tun/tap interface in the host for each VM, setup the host to forward packets (and masquerade if necessary), and then you can add the correct filtering rules (with
iptablesifufwcan't do that).– dirkt
Aug 29 at 5:42