I have a debian 10 host and I am running a debian 10 guest using NAT. I am using libvirt/KVM/QEMU
host public ip: x.x.x.x
guest ip: 192.168.122.99
I am trying to forward port 22221 to port 22 in the guest for me to access the guest via ssh from the outside. I want to connect to the guest via ssh directly using ssh -p 22221 x.x.x.x
I am following this tutorial: https://wiki.libvirt.org/page/Networking#Forwarding_Incoming_Connections
I also tried countless other tutorials, and none worked. In particular I have no idea why the following does not work:
(inside host)
1- I shutdown the guest vm using virt-manager
2- I manually call the hook script ip tables to forward the port
sudo iptables -D FORWARD -o virbr0 -d 192.168.122.99 --dport 22 -j ACCEPT
sudo iptables -t nat -D PREROUTING -p tcp --dport 22221 -j DNAT --to 192.168.122.99:22
3- I start the guest vm and check that ssh 192.168.122.99
is working
4- Now I try to connect using ssh -p 22221 localhost
and it refuses connection.
I also tried to check the port nmap -p 22221 localhost
and it says it is blocked.
iptables -L (host)
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dpt:domain
ACCEPT tcp -- anywhere anywhere tcp dpt:domain
ACCEPT udp -- anywhere anywhere udp dpt:bootps
ACCEPT tcp -- anywhere anywhere tcp dpt:67
ACCEPT tcp -- anywhere anywhere tcp dpt:http
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere 192.168.122.99
ACCEPT all -- anywhere 192.168.122.0/24 ctstate RELATED,ESTABLISHED
ACCEPT all -- 192.168.122.0/24 anywhere
ACCEPT all -- anywhere anywhere
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
ip a (host)
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 00:25:90:97:dc:6e brd ff:ff:ff:ff:ff:ff
inet x.x.x.x/23 brd y.y.y.y scope global enp2s0f0
valid_lft forever preferred_lft forever
inet6 fe80::225:90ff:fe97:dc6e/64 scope link
valid_lft forever preferred_lft forever
3: enp2s0f1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether 00:25:90:97:dc:6f brd ff:ff:ff:ff:ff:ff
4: virbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 52:54:00:60:e8:80 brd ff:ff:ff:ff:ff:ff
inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
valid_lft forever preferred_lft forever
5: virbr0-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast master virbr0 state DOWN group default qlen 1000
link/ether 52:54:00:60:e8:80 brd ff:ff:ff:ff:ff:ff
7: vnet0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master virbr0 state UNKNOWN group default qlen 1000
link/ether fe:54:00:e4:c2:52 brd ff:ff:ff:ff:ff:ff
inet6 fe80::fc54:ff:fee4:c252/64 scope link
valid_lft forever preferred_lft forever
ip a (guest)
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 52:54:00:e4:c2:52 brd ff:ff:ff:ff:ff:ff
inet 192.168.122.99/24 brd 192.168.122.255 scope global dynamic enp1s0
valid_lft 2500sec preferred_lft 2500sec
inet6 fe80::5054:ff:fee4:c252/64 scope link
valid_lft forever preferred_lft forever
Best Answer
The example script on the libvirt wiki seems to be missing "-p" in the FORWARD lines, the proper way to issue it is: