Re: SSH VM from outside, but not from host

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]


On 2/16/22 4:40 AM, Peter Crowther wrote:
... hang on.  Why does the *bridge* have an IP address?  Think of a bridge as being like a switch; it has no address of its own.

It's not the IP address of the bridge, it's the IP address of the "default / built-in" port of the bridge. The standard way to configure a Linux host bridge is to attach the host's physical ethernet to the bridge, and move the IP config from the ethernet device to the bridge device. This is because each Linux host bridge has a single port (netdev) that is connected to the routing stack of the host's kernel. So traffic comes in the ethernet, to the port on the bridge that's connected to the ethernet, and then sent out of the bridge via this "built-in" port up to the host's IP stack for either reception by the host, or routing by IP. Since this built-in port is "closer" to the host kernel, it makes sense for the IP config to be there (at least that's how I think about it).

The comment I have about the *original* problem is this: what's being described sounds exactly like what would happen if the guest config was using <interface type='direct'> rather than <interface type='bridge'>. Because the description talks about being connectd via a bridge, I at first I assumed that the connection is <interface type='bridge'>, but then just now realized that although it is pointless to use type='direct' (a macvtap device) to connect via a bridge, it still would work (except host<->guest communication wouldn't work), so it's at least worth asking if possibly type='direct' was used by mistake.

Probably not the issue here, but I thought I should throw it out there just in case :-)



On Tue, 15 Feb 2022 at 20:21, Wolf <ort_libvirt@xxxxxxxxxxxx <mailto:ort_libvirt@xxxxxxxxxxxx>> wrote:

    On 15 Feb 2022, at 20:04, Peter Crowther
    <peter.crowther@xxxxxxxxxxxx <mailto:peter.crowther@xxxxxxxxxxxx>>

    And eno1 and eno2 are *both* connected to the same external
    switch, yes?

    Correct, where each NIC has its ip access-list.
    XX1.XX1.XX1.150 and XX2.XX2.XX2.100 are on separate NICs.

    When I ping the VM, XX2.XX2.XX2.100, from the host, XX1.XX1.XX1.150,
    the host pings itself.



    On Tue, 15 Feb 2022 at 17:17, Wolf <ort_libvirt@xxxxxxxxxxxx
    <mailto:ort_libvirt@xxxxxxxxxxxx>> wrote:


        1) I have two network ports on my server.
         -      eno1 has the IP: XX1.XX1.XX1.150

         -      bridge0 has the IP: XX2.XX2.XX2.100
                and has the interface member: port eno2.
                eno2 is not set up with an IP address.

        2) The host runs on IP: XX1.XX1.XX1.150

        3) A VM uses the bridge: bridge0, and has the IP: XX2.XX2.XX2.100

        I have a problem with this setup:
        I can ssh the VM on XX2.XX2.XX2.100 from outside, but from the
        host, XX1.XX1.XX1.150, I can't ssh the VM on XX2.XX2.XX2.100.

        Have I set up this wrong or is it something I can do to solve



[Index of Archives]     [Virt Tools]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [KDE Users]

  Powered by Linux