0

I am connected via VPN to a Ubuntu server acting as a hypervisor, running 1 VM. I can ping the VM from command-line on the server, but am unable to ping the VM via my VPN connection on my computer. All ping's return "Destination Port Unreachable"

I have a virbr1 like this: virbr1 Link encap:Ethernet HWaddr 52:54:00:cb:4d:9b inet addr:10.0.100.1 Bcast:10.0.100.31 Mask:255.255.255.224 (created by Libvirt)

I have 1 VM running on the hypervisor with IP 10.0.100.16 which I can ping from the hypervisor, but not via VPN.

My openvpn server.conf has: server 10.0.1.0 255.255.255.240 push "route 10.0.100.0 255.255.255.224"

on my client, I can ping 10.0.100.1 but I can't ping 10.0.100.16: PING 10.0.100.16 (10.0.100.16) 56(84) bytes of data. From 10.0.1.1 icmp_seq=1 Destination Port Unreachable

It appears that instead of 10.0.100.16 the ping response contains 10.0.1.1.

When I tcpdump tun1 on the hypervisor, I see: IP 10.0.1.6 > 10.0.100.16: ICMP echo request, id 26073, seq 1, length 64 IP 10.0.1.1 > 10.0.1.6: ICMP 10.0.100.16 protocol 1 port 43991 unreachable, length 92

for some reason 10.0.1.1 is used instead of 10.0.100.16 for the ICMP reply.

Any ideas what might be wrong? Incorrect routing, missing iptables?

  • Use host-only networking instead of nat. – Ipor Sircer Oct 24 '17 at 15:27
0

You don't mention what configuration you have for the libvirt virtual network associated with the virbr0 device. The default configuration libvirt makes is to setup NAT based connectivity. In such a setup, libvirt has firewall rules that apply NAT to the outbound connections. Inbound connections are only accepted from the host OS itself - there's no routing from networks off-host, which I think will probably include your VPN connection.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.