On 2020-06-18 04:32, Eric Garver wrote:
On Thu, Jun 18,
2020 at 03:45:41AM +0800, Ed Greshko wrote:
On 2020-06-18 00:50, Eric Garver wrote:
I didn't see anything odd in your
configuration. Can you show the actual rulesets?
i.e.
  # nft list ruleset
and
  # iptables-save
OK....
Due the the length of the output I'll attach 2 .txt files.Â
Hope that is acceptable.
# Generated by iptables-save v1.8.4 on Thu
Jun 18 03:40:11 2020
*nat
:PREROUTING ACCEPT [42898:17141290]
:INPUT ACCEPT [3599:509438]
:OUTPUT ACCEPT [12945:1130908]
:POSTROUTING ACCEPT [12319:1005476]
:LIBVIRT_PRT - [0:0]
-A POSTROUTING -j LIBVIRT_PRT
-A LIBVIRT_PRT -s 192.168.122.0/24 -d 224.0.0.0/24 -j RETURN
-A LIBVIRT_PRT -s 192.168.122.0/24 -d 255.255.255.255/32 -j
RETURN
-A LIBVIRT_PRT -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp
-j MASQUERADE --to-ports 1024-65535
-A LIBVIRT_PRT -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp
-j MASQUERADE --to-ports 1024-65535
-A LIBVIRT_PRT -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j
MASQUERADE
This shows the libvirt network is 192.168.122.0/24. That
contradicts what you said in your original email.
Well, I got my directions wrong.
The VM is on the left. The Wifi connected system is on the right.
"I have 3 systems. 2 HW, 1VM. The 2 HW systems are
connected via Wifi. Below the VM is on the right.
192.168.122.152<---->192.168.122.1/192.168.2.127<---->192.168.2.116"
Knowing this and..
Does that change anything?
[..]
-A FORWARD -j LIBVIRT_FWI
-A FORWARD -j LIBVIRT_FWO
-A OUTPUT -j LIBVIRT_OUT
-A LIBVIRT_FWI -d 192.168.122.0/24 -o virbr0 -m conntrack
--ctstate RELATED,ESTABLISHED -j ACCEPT
-A LIBVIRT_FWI -o virbr0 -j REJECT --reject-with
icmp-port-unreachable
..this bit. It's not a surprised you're getting ICMP unreachable.
libvirt's rules are rejecting the packet. The only reason it works
after you disable firewalld is because firewalld flushes the
iptables ruleset on shutdown. I bet if you stop firewalld, then
restart libvirt it still will _not_ work.
I think in the end you need to setup port forwarding for SSH
inside libvirt's configuration.
Even that wouldn't explain why, with the middle system 3 interfaces
being 192.168.122.1/192.168.1.18/192.168.2.127 I can't ssh to
192.168.1.142 from 2.116 with the FW up.