While practicing for SysAdmin certification, I spun up a virtual machine. I could not SSH into it from my laptop on my LAN. I could SSH into the VM from within the host OS. After some reading and running traceroute, I realized that the virtual bridge was on a subnet, so on my laptop I ran ip route add via Now traceroute yields,

 1  2.717 ms  2.807 ms  2.780 ms
 2  2.782 ms  2.786 ms  3.932 ms

Ping yields, icmp_seq=1 Destination Port Unreachable. Since the traceroute does not route through my router, I don't suspect my router's firewall is the problem. I suppose the firewall in my host desktop or in the VM could be the problem, but the VM's iptables are empty.

Apparently virt-install no longer saves the domain's configuration in /etc/xen. From my history, the command I used was

sudo virt-install --connect xen:// --paravirt -n quark -f /dev/ubuntu-vg/qark -l /vm/OS/debian-9.4.0-amd64-netinsta.iso -r 8192 --vcpus --nographics --os-variant debian9

Also, virbr0: inet, and the host dom0 is Ubuntu 18 LTS with Xen 4.9.

  • Can you add the Xen configuration you've used for that specific VM in your question? – Fanatique Sep 20 '18 at 6:35

I recalled that iptables doesn't automatically save changes, so I flush the host OS's rules. Then I was able to login to my VM directly. Now I just need to figure out a prudent ruleset for the host OS. If the edge router is firewalled, I still unclear as to why each host needs a firewall, but that's a question for another day.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.