Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Windows XP VM running inside a Linux host. My Linux machine is connected through OpenVPN to the network of my company, which I do not want the Windows machine to access. A problem which I thought would be trivial to solve seems quite a bit harder.

My idea was to limit VirtualBox' access through iptables on the host machine, simply dropping everything from the guest -> vpn. However, unlike Xen, I cannot seem to get a bridge interface to show up in my host. Am I missing something here? Has someone experience running a firewall on the host for the guest machine?

share|improve this question
up vote 3 down vote accepted

I have a similar setup running. You didn't mention your Linux distribution, but I'm using Ubuntu Linux 11.10. Any other distribution should work in a quite similar fashion.

As far as I know, the way I'm doing this is still documented somewhat by VirtualBox, but is no longer their default method for connecting the networking of VirtualBox to the host. Basically, you need to install uml-utilities (part of User-mode Linux). Then, add an interface to /etc/network/interfaces, something like this:

auto vbox1
iface vbox1 inet static
  tunctl_user virtualbox

After you bring this interface up, you can then bridge VirtualBox to it. You don't want to bridge this interface to anything else (like eth0) - otherwise your VM would again have full access to the network. Instead, you want to route traffic between this network and any other allowed resources - and in this case, denying access to your VPN network. Note that this requires net.ipv4.ip_forward=1 to be specified in something like /etc/sysctl.conf.

These are the specific portions of my iptables setup relating to the VirtualBox restricted network. You may wish to tweak this to your specific needs, but this should give you a good start:

# Must be able to access DNS running on the host itself (everything else is denied elsewhere).
iptables -A INPUT -i vbox1 -p udp --dport 53 -j ACCEPT

iptables -A INPUT -i vbox1 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i vbox1 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow access out to the Internet.
iptables -A FORWARD -i vbox1 -o $WAN_IF -j ACCEPT

As long as you set WAN_IF to your Internet connection (and add similar rules for other allowed Interfaces or addresses), but don't add an allowed path to your VPN, this should meet your requirements.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.