Arch Linux

Fred7109

Member

Registered: 2015-05-17

Posts: 134

[SOLVED] Allow Virtualbox in iptables

Hello community,

I have the following iptables rules

Chain INPUT (policy DROP 8 packets, 2028 bytes)
target     prot opt in     out     source               destination         
ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
ACCEPT     tcp  --  tun+   *       0.0.0.0/0            [IP of email]       multiport sports 465,993

Chain FORWARD (policy DROP 0 packets, 0 bytes)
target     prot opt in     out     source               destination         

Chain OUTPUT (policy DROP 183 packets, 13249 bytes)
target     prot opt in     out     source               destination         
ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0           
ACCEPT     tcp  --  *      tun+    0.0.0.0/0            0.0.0.0/0           
ACCEPT     icmp --  *      tun+    0.0.0.0/0            0.0.0.0/0            state NEW,RELATED,ESTABLISHED
ACCEPT     tcp  --  *      wlo+    0.0.0.0/0            [IP of VPN]       tcp dpt:1208
ACCEPT     tcp  --  *      eno+    0.0.0.0/0            [IP of VPN]       tcp dpt:1208
ACCEPT     tcp  --  *      wlo+    0.0.0.0/0            [IP of DNS]         tcp dpt:443
ACCEPT     tcp  --  *      eno+    0.0.0.0/0            [IP of DNS]         tcp dpt:443

These rules breaks the internet access in my virtualbox guest, however, does someone know how to allow virtualbox's guest's to have internet access?

I have tried to allow local ip's, with the below commands, but that doesn't solve the issue either.

iptables -A INPUT -s 192.168.0.0/16 -d 192.168.0.0/16 -j ACCEPT
iptables -A OUTPUT -s 192.168.0.0/16 -d 192.168.0.0/16 -j ACCEPT
iptables -A INPUT -s 172.16.0.0/12 -d 172.16.0.0/12 -j ACCEPT
iptables -A OUTPUT -s 172.16.0.0/12 -d 172.16.0.0/12 -j ACCEPT
iptables -A INPUT -s 10.0.0.0/8 -d 10.0.0.0/8 -j ACCEPT
iptables -A OUTPUT -s 10.0.0.0/8 -d 10.0.0.0/8 -j ACCEPT

Any help would be greatly appreciated.

Last edited by Fred7109 (2017-08-03 12:06:27)

mouseman

Member

From: Outta nowhere

Registered: 2014-04-04

Posts: 298

Re: [SOLVED] Allow Virtualbox in iptables

How are you guests configured with regard to networking? NAT, bridged, something else?

I would create a logging rule to log all packets from a VM source IP address to figure out what it is doing.

brebs

Member

Registered: 2007-04-03

Posts: 3,742

Re: [SOLVED] Allow Virtualbox in iptables

Use logndrop, then you can see yourself what you're dropping.

Also, show us the iptables config properly (fully detailed and ordered), using:

iptables-save

Fred7109

Member

Registered: 2015-05-17

Posts: 134

Re: [SOLVED] Allow Virtualbox in iptables

Thank you for the help mouseman and brebs.

I have only been used to very simple iptable configurations, so after setting up a new chain for logging I was able to find the problem. It all ended up being there was no problem with my iptable configuration, I saw in my logs that the expected packages went through, but the fact that I use DNScrypt on port 443, so of course no DNS lookups could be made in virtualbox guest. After changing DNS server on my virtualbox guest, everything is working fine.