[Original] failure in DNS domain name resolution in KVM Virtual Machine

Environment:

HOST: centos 5.6 x86_64 + KVM

Virtual Machine: centos 5.6 x86_64, Windows 2003 Server

Problem:

• On a physical machine, you can use a domain name to access a website. On a virtual machine, you cannot use a domain name to access the website, but you can access the website through an IP address.
• After the firewall (iptables) of the physical machine is disabled, the virtual machine can use the domain name to access the website.

Analysis:

It should be a problem with the configuration of the physical machine firewall (iptables ).

Solution:

The physical machine firewall has an impact on the domain name resolution of virtual machines. Port 53 is used for domain name resolution, so check port 53 of the physical machine: [Root @ centos56 ~] # Netstat-ano | grep 53tcp 0 0 192.168.122.1: 53 0.0.0.0: * Listen off (0.00/0/0) TCP 0 0 211.98.99.249: 5904 61.237.253.2: 10455 established off (0.00/0/0) TCP 0 0 Protocol: 445 61.237.253.2: 35742 established keepalive (3697.76/0/0) TCP 0 52 Protocol: 22 61.237.253.2: 41058 established on (0.41/0/0) TCP 0 Protocol: 5904 61.237.253.2: 61023 established off (0.00/0/0) TCP 0 Protocol: 5903 61.237.253.2: 32072 established off (0.00/0/0) TCP 0 Protocol: 5902 61.237.253.2: 16918 established off (0.00/0/0) TCP 0 0 211.98.99.249: 445 61.237.253.2: 34823 established keepalive (4749.99/0/0) UDP 0 192.168.122.1: 53 0.0.0.0: * Off (0.00/0/0) UDP 0 0.0.0.0: 5353 0.0.0.0: * Off (0.00/0/0) Port 53 is enabled on 192.168.122.1. The original KVM opened the domain name resolution service on virbr0. 192.168.122.1 is the IP address of the virtual bridge virbr0.

[Root @ centos56 ~] # Ifconfig virbr0virbr0 link encap: Ethernet hwaddr 00: 00: 00: 00: 00: 00 Inet ADDR: 192.168.122.1 bcast: 192.168.122.255 mask: 255.255.0 up broadcast running Multicast MTU: 1500 Metric: 1 RX packets: 0 errors: 0 dropped: 0 overruns: 0 frame: 0 TX packets: 2086 errors: 0 dropped: 0 overruns: 0 carrier: 0 Collisions: 0 txqueuelen: 0 RX Bytes: 0 (0.0 B) TX Bytes: 548897 (536.0 kib)

 

Solution: Modify the iptables configuration of the physical machine and add port 53 to the firewall. [Root @ centos56 ~] # VI/etc/sysconfig/iptables

# Firewall configuration written
System-config-securitylevel
# Manual customization of this file is not
Recommended.
* Filter
: Input accept [0: 0]
: Forward accept
[0: 0]
: Output accept [0: 0]
: RH-Firewall-1-INPUT-[0: 0]
-A input-J
RH-Firewall-1-INPUT
-A forward-J RH-Firewall-1-INPUT
-
RH-Firewall-1-INPUT-I lo-J accept
-A RH-Firewall-1-INPUT-P ICMP
-- ICMP-type any-J accept
-A RH-Firewall-1-INPUT-M state -- state
Established, related-J accept
-A RH-Firewall-1-INPUT-M state -- state new-m
TCP-p tcp -- dport 22-J accept
-A RH-Firewall-1-INPUT-M state -- state new
-M tcp-p tcp -- dport 80-J accept
-A RH-Firewall-1-INPUT-M state -- state
New-m tcp-p tcp -- dport 21-J accept
-A RH-Firewall-1-INPUT-M state
-- State new-m tcp-p tcp -- dport 5901-J accept
-A RH-Firewall-1-INPUT-m
State -- state new-m tcp-p tcp -- dport 5902-J accept

-
RH-Firewall-1-INPUT-M state -- state new-m udp-p udp -- dport 138-J
Accept
-A RH-Firewall-1-INPUT-M state -- state new-m tcp-p tcp -- dport 139
-J accept
-A RH-Firewall-1-INPUT-M state -- state new-m tcp-p tcp -- dport
445-J accept

-A RH-Firewall-1-INPUT-M state
-- State new-m udp-p udp -- dport 53-J accept
-A RH-Firewall-1-INPUT-m
State -- state new-m tcp-p tcp -- dport 53-J
Accept

-A RH-Firewall-1-INPUT-J reject -- reject-
ICMP-host-prohibited

Commit

After the preceding modification, use service iptables restart to restart the firewall.