I've got a Fedora 26 QEMU guest VM with a LAMP application running on a Fedora 25 host. I can access the guest web server from both the guest and the host, but I can't access it from the other systems on my local LAN - and I'd like to be able to do that.
I've put a host static route entry in my router (LEDE) to route the F26 guest's static IPv4 address (192.168.122.186) to the F25 host. The F25 host already has a network route entry for the virbr0 v-interface (192.168.122.0/24).
It seems that the F25 host firewall is what's blocking the access because when I disable firewalld on the F25 host, it works as required.
I'd appreciate a pointer to how to wrangle firewalld in this type of configuration.
Edit 2017/12/11:
I started off with only one firewalld zone (public), but now I'm trying 2 (public and internal). The "services" (ports) shown below have always been open. http and https, in particular, are what I need to work.
I need to route the traffic from devices on my local LAN, 10.3.2.0/24, (except the F25 host, of course) through the F25 host to the F26 guest VM. As I wrote before, the routing appears to be working, except when firewalld is running on the F25 host - in which case this traffic is blocked.
I've spent a lot of time searching, and there are two recurring topics, forwarding and masquerading. None of the things suggested has done what I require, however.
How can I do this? Tx
========== running: firewall-cmd --get-zones ===========
FedoraServer FedoraWorkstation block dmz drop external home internal public trusted work
========== running: firewall-cmd --get-active-zones ===========
internal
interfaces: virbr0
public
interfaces: enp0s31f6
========== running: firewall-cmd --get-default-zone ===========
public
========== running: firewall-cmd --zone=public --list-all ===========
public (active)
target: default
icmp-block-inversion: no
interfaces: enp0s31f6
sources:
services: mdns ssh dhcpv6-client http https
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
========== running: firewall-cmd --zone=internal --list-all ===========
internal (active)
target: ACCEPT
icmp-block-inversion: no
interfaces: virbr0
sources:
services: ssh http https dhcpv6-client mdns
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
$ ifconfig -a # on the F25 host
enp0s31f6: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.3.2.10 netmask 255.255.255.0 broadcast 10.3.2.255
inet6 xxxxxxxxxxxxxxxxxxxxxxxxx prefixlen 64 scopeid 0x20<link>
inet6 xxxxxxxxxxxxxxxxxxx prefixlen 128 scopeid 0x0<global>
inet6 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx prefixlen 64 scopeid 0x0<global>
ether xxxxxxxxxxxxxxxxx txqueuelen 1000 (Ethernet)
RX packets 145 bytes 16680 (16.2 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 217 bytes 27947 (27.2 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device interrupt 16 memory 0xf7000000-f7020000
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 24 bytes 2056 (2.0 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 24 bytes 2056 (2.0 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
virbr0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.122.1 netmask 255.255.255.0 broadcast 192.168.122.255
ether 52:54:00:93:ae:d3 txqueuelen 1000 (Ethernet)
RX packets 99 bytes 11189 (10.9 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 73 bytes 9612 (9.3 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
virbr0-nic: flags=4098<BROADCAST,MULTICAST> mtu 1500
ether 52:54:00:93:ae:d3 txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
vnet0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet6 fe80::fc54:ff:fe7c:437c prefixlen 64 scopeid 0x20<link>
ether fe:54:00:7c:43:7c txqueuelen 1000 (Ethernet)
RX packets 99 bytes 12575 (12.2 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 195 bytes 17988 (17.5 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
$ netstat -rn
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 10.3.2.1 0.0.0.0 UG 0 0 0 enp0s31f6
10.3.2.0 0.0.0.0 255.255.255.0 U 0 0 0 enp0s31f6
192.168.122.0 0.0.0.0 255.255.255.0 U 0 0 0 virbr0
