How to block all traffic on a VM except host IP?

Fyrie

8/15/23, 4:27 PM

I am running a Vagrant VM and am trying to have a network isolated mode. Since disabling or changing anything with the default NAT interface breaks Vagrant I decided to block ALL traffic inside the CentOS 7 VM except the host IP.

Let's make 1.1.1.1 the host's IP

This is the command I am trying inside the Guest CentOS 7 VM:

sudo firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -s 1.1.1.1 -j ACCEPT && \
sudo firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -d 1.1.1.1 -j ACCEPT && \
sudo firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 1 -j DROP && \
sudo firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 1 -j DROP && \
sudo firewall-cmd --reload

With this I am able to ping from the Guest to the Host but am unable to ping the Guest from the Host.

What am I doing wrong? Basically, I just need to have SSH, TCP, and UDP access to the VM and host.

0 + 0

virtual-machines

centos

firewalld

djdomi

8/15/23, 5:11 PM

remove the default gateway and its mostly isolated. you cab also run a vlan to separate it also

Fyrie

8/15/23, 6:35 PM

I removed the default gateway and it is working! But then I realized nmap isn't able to scan the target. ```Offending packet: TCP 192.168.1.1:44126 > 192.168.1.225:111 S ttl=57 id=39288 iplen=44 seq=1857285822 win=1024 <mss 1460> sendto in send_ip_packet_sd: sendto(6, packet, 44, 0, 192.168.1.225, 16) => Operation not permitted ```

djdomi

8/17/23, 5:01 PM

i cant read a comment that needs to ve added to the question. please remind to edit the question instead of a comment

Score:1

Server

Fyrie

8/15/23, 7:23 PM

It looks like @djdomi's answer is working for me.

I deleted the gateway with the following command in the VM

sudo ip route del 0/0

Network was disconnected. However, I was able to SSH using vagrant ssh

Initially I was stuck trying to use nmap to scan the VM but I was using the private_network's static IP which did not work. Using the Vagrant's NAT IP I was able to ping from host to VM as well as nmap scans.

0 + 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: How to block all traffic on a VM except host IP?

TH: จะบล็อกการรับส่งข้อมูลทั้งหมดบน VM ยกเว้นโฮสต์ IP ได้อย่างไร

RO: Cum să blochezi tot traficul pe o VM, cu excepția IP-ului gazdă?

RU: Как заблокировать весь трафик на виртуальной машине, кроме IP-адреса хоста?

VI: Làm cách nào để chặn tất cả lưu lượng truy cập trên VM ngoại trừ IP máy chủ?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.