[Qemu-devel] [Bug 1696746] [NEW] netdev user, restrict=on prevents forwarded ports from being accessed from other systems

[Nathan Rennie-Waldock]

Public bug reported:

I've got a guest only network and I'm wanting to access SSH on one of the 
guests externally.
I'm using -netdev user,id=usernet0,hostfwd=tcp::2222-:22,restrict=yes -device 
virtio-net-pci,netdev=usernet0
to forward 2222 to 22 in the guest.

The docs state:
restrict=on|off

    If this option is enabled, the guest will be isolated, i.e. it will
not be able to contact the host and no guest IP packets will be routed
over the host to the outside. This option does not affect any explicitly
set forwarding rules.


However, with restrict=on, the forwarded port is only accessible from the host. 
Other systems receive no data.

This was tested with qemu 2.8. Changelog for 2.9 doesn't mention any
(relevant) user networking changes, so that should also fail.

** Affects: qemu
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1696746

Title:
  netdev user,restrict=on prevents forwarded ports from being accessed
  from other systems

Status in QEMU:
  New

Bug description:
  I've got a guest only network and I'm wanting to access SSH on one of the 
guests externally.
  I'm using -netdev user,id=usernet0,hostfwd=tcp::2222-:22,restrict=yes -device 
virtio-net-pci,netdev=usernet0
  to forward 2222 to 22 in the guest.

  The docs state:
  restrict=on|off

      If this option is enabled, the guest will be isolated, i.e. it
  will not be able to contact the host and no guest IP packets will be
  routed over the host to the outside. This option does not affect any
  explicitly set forwarding rules.

  
  However, with restrict=on, the forwarded port is only accessible from the 
host. Other systems receive no data.

  This was tested with qemu 2.8. Changelog for 2.9 doesn't mention any
  (relevant) user networking changes, so that should also fail.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1696746/+subscriptions