Ubuntu – Restricting guest connections in QEMU virtual machine, how

kvm-virtualizationnetworkingqemuUbuntuvirtualization

I run QEMU to emulate Windows KVM. I currently use -net nic with -net user to access WAN from guest, and this works like plain tunnel with no possibility to control connections, add whitelist or restrictions.

It is also dangerous setup due to the IP level packet forwarding, e.g. ports are open and all low-level connections on guest are possible. Say if i am running malware, such can function in nearly real networking environment.

Say i have running proxy socks5://127.0.0.1:9050/ on host and my host Internet connection is wlan0. How can i force QEMU to use such proxy as networking adapter, is there any solution? So at least, i will use Tor for my guests for privacy.

I've managed to setup TAP networking adapter virbr0 for my guest and enable it with command line -netdev bridge,br=virbr0,id=net0 -device virtio-net-pci,netdev=net0 (and allowed virbr0 in /etc/qemu/bridge.conf). Howerver, i don't have internet access with such bridge and don't actually understand how can i use iptables to restrict outgoing/incoming connections for my VM

Previous title: Is there a way to convert SOCKS proxy to a network bridge interface?

Best Answer

This won't work. SOCKS is an application-level protocol, not a generic networking mechanism. If you desire to use a SOCKS proxy with an application, you'll need to ensure that the application supports using a proxy, and is configured to do so.

Related Topic