Tengo una VM KVM libvirt (llamada netstuff) ejecutándose a través de un puente (br0) que tiene dos esclavos: (em2) una interfaz física de host y (vnet0) la NIC virtual. dnsmasq-dhcp está en el host y proporciona direcciones IP a la VM y otros hosts físicos.
Puedo enrutar a cualquier lugar en 192.168.1.0/24, incluso entre la VM y el hardware, pero la VM no puede enrutar a la otra red ni a Internet. Cuando el tráfico del invitado sale hacia el host, no parece encaminarse desde el puente a la interfaz em1, que tiene la ruta predeterminada.
¿Ayuda?
Anfitrión libvirt XML:
# virsh dumpxml netstuff
... snip ...
<interface type='bridge'>
<mac address='52:54:00:27:c4:22'/>
<source bridge='br0'/>
<target dev='vnet0'/>
<model type='virtio'/>
<alias name='net0'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
</interface>
... snip ...
Rutas IP del host:
# ip r
default via XXX.99.126.1 dev em1
169.254.0.0/16 dev em1 scope link metric 1002
169.254.0.0/16 dev br0 scope link metric 1004
192.168.1.0/24 dev br0 proto kernel scope link src 192.168.1.1
XXX.99.126.0/27 dev em1 proto kernel scope link src XXX.99.126.4
NIC de host:
# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: em1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
link/ether d4:ae:52:9d:73:c2 brd ff:ff:ff:ff:ff:ff
inet XXX.99.126.4/27 brd XXX.99.126.31 scope global em1
valid_lft forever preferred_lft forever
inet6 fe80::d6ae:52ff:fe9d:73c2/64 scope link
valid_lft forever preferred_lft forever
3: em2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master br0 state UP qlen 1000
link/ether d4:ae:52:9d:73:c3 brd ff:ff:ff:ff:ff:ff
inet6 fe80::d6ae:52ff:fe9d:73c3/64 scope link
valid_lft forever preferred_lft forever
4: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
link/ether d4:ae:52:9d:73:c3 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.1/24 brd 192.168.1.255 scope global br0
valid_lft forever preferred_lft forever
inet6 fe80::d6ae:52ff:fe9d:73c3/64 scope link
valid_lft forever preferred_lft forever
5: vnet0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master br0 state UNKNOWN qlen 1000
link/ether fe:54:00:27:c4:22 brd ff:ff:ff:ff:ff:ff
inet6 fe80::fc54:ff:fe27:c422/64 scope link
valid_lft forever preferred_lft forever
Servidor de iptables:
# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
INPUT_direct all -- anywhere anywhere
INPUT_ZONES_SOURCE all -- anywhere anywhere
INPUT_ZONES all -- anywhere anywhere
DROP all -- anywhere anywhere ctstate INVALID
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere PHYSDEV match --physdev-is-bridged
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
FORWARD_direct all -- anywhere anywhere
FORWARD_IN_ZONES_SOURCE all -- anywhere anywhere
FORWARD_IN_ZONES all -- anywhere anywhere
FORWARD_OUT_ZONES_SOURCE all -- anywhere anywhere
FORWARD_OUT_ZONES all -- anywhere anywhere
DROP all -- anywhere anywhere ctstate INVALID
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
OUTPUT_direct all -- anywhere anywhere
Chain FORWARD_IN_ZONES (1 references)
target prot opt source destination
FWDI_public all -- anywhere anywhere [goto]
FWDI_public all -- anywhere anywhere [goto]
FWDI_public all -- anywhere anywhere [goto]
Chain FORWARD_IN_ZONES_SOURCE (1 references)
target prot opt source destination
Chain FORWARD_OUT_ZONES (1 references)
target prot opt source destination
FWDO_public all -- anywhere anywhere [goto]
FWDO_public all -- anywhere anywhere [goto]
FWDO_public all -- anywhere anywhere [goto]
Chain FORWARD_OUT_ZONES_SOURCE (1 references)
target prot opt source destination
Chain FORWARD_direct (1 references)
target prot opt source destination
Chain FWDI_public (3 references)
target prot opt source destination
FWDI_public_log all -- anywhere anywhere
FWDI_public_deny all -- anywhere anywhere
FWDI_public_allow all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere
Chain FWDI_public_allow (1 references)
target prot opt source destination
Chain FWDI_public_deny (1 references)
target prot opt source destination
Chain FWDI_public_log (1 references)
target prot opt source destination
Chain FWDO_public (3 references)
target prot opt source destination
FWDO_public_log all -- anywhere anywhere
FWDO_public_deny all -- anywhere anywhere
FWDO_public_allow all -- anywhere anywhere
Chain FWDO_public_allow (1 references)
target prot opt source destination
Chain FWDO_public_deny (1 references)
target prot opt source destination
Chain FWDO_public_log (1 references)
target prot opt source destination
Chain INPUT_ZONES (1 references)
target prot opt source destination
IN_public all -- anywhere anywhere [goto]
IN_public all -- anywhere anywhere [goto]
IN_public all -- anywhere anywhere [goto]
Chain INPUT_ZONES_SOURCE (1 references)
target prot opt source destination
Chain INPUT_direct (1 references)
target prot opt source destination
REJECT tcp -- anywhere anywhere multiport dports ssh match-set fail2ban-sshd src reject-with icmp-port-unreachable
Chain IN_public (3 references)
target prot opt source destination
IN_public_log all -- anywhere anywhere
IN_public_deny all -- anywhere anywhere
IN_public_allow all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere
Chain IN_public_allow (1 references)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dpt:bootps ctstate NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh ctstate NEW
Chain IN_public_deny (1 references)
target prot opt source destination
Chain IN_public_log (1 references)
target prot opt source destination
Chain OUTPUT_direct (1 references)
target prot opt source destination
Rutas IP de invitados:
ssh [email protected]
Last login: Sat Apr 8 05:29:55 2017 from 192.168.1.1
[centos@netstuff ~]$ ip r
default via 192.168.1.1 dev eth0
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.76
[centos@netstuff ~]$
NIC invitadas:
[centos@netstuff ~]$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 52:54:00:27:c4:22 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.76/24 brd 192.168.1.255 scope global dynamic eth0
valid_lft 2978sec preferred_lft 2978sec
inet6 fe80::5054:ff:fe27:c422/64 scope link
valid_lft forever preferred_lft forever
Respuesta1
Resulta que esto es imposible sin NAT, así que volví a habilitar la defaultred NAT con virsh net-start default. El uso de libvirt de dnsmasq tiene cuidado de que el servidor DHCP se ejecute solo en la interfaz que crea. Así que simplemente me aseguré de que el dnsmasq que configuré en el host no interfiriera con el dnsmasq creado por libvirt. Para hacerlo, /etc/dnsmasq.confpuse dnsmasq en bind-interfacesmodo y lo obligué a escuchar en el puente que hice (br0) indicando la IP estática que le di: 192.168.1.1
listen-address=192.168.1.1
bind-interfaces
Y por supuesto:
systemctl restart dnsmasq
Consulte aquí las preguntas frecuentes de dnsmasq y las configuraciones de "bind-interface" y "bind-dynamic". http://www.thekelleys.org.uk/dnsmasq/docs/FAQ