Thanks for your help everyone.

I have solved the original problem: it was not firewalld, sshd, or the sysctl.

It was the virtual network associated to bridge virbr1 (here called "hyperspace") that was not properly configured.

This is what solved everything:





seldon@trantor:~ $ sudo virsh net-edit hyperspace



And replace this line:



<forward mode='nat'/>



With this one:



<forward dev='enp4s1' mode='route'><interface dev='enp4s1'/></forward>



Regards,



Benjamin Lefoul

________________________________________

From: Nico Kadel-Garcia <[log in to unmask]>

Sent: 28 April 2016 13:49:11

To: Karel Lang AFD

Cc: Benjamin Lefoul; [log in to unmask]

Subject: Re: SSH port forward with firewalld



On Thu, Apr 28, 2016 at 7:30 AM, Karel Lang AFD <[log in to unmask]> wrote:

> Hi,

>

> i see 2 basic ways howto go about this

>

> firstly,

> yes, you can solve this by port-forwarding on the iptables level on the host

> machine.

> Unfortunately, i dont use firewalld, i use only iptables, so can't say if

> your config is right or not.

>

> But basically if the forwarding firewall rule works, then after you issue:

>

> ssh user@IP-of-host-machine -p portnumber-that-is-forwarded

>

> then you are immediately redirected at guest machine and you should get pw

> prompt from guest - if not, something is wrong - probably on firewall.



A lot of complex port forwarding solutions can be avoided by simply

using "socat", or using "inetd" to do port forwarding and staying out

of the firewall rules. Not that SSH port forwarding isn't extremely

useful. But if you don't actually need to protect the port forwarding

from man-in-the-middle attacks, it can be much faster. I use those to

expose SSL ports, such as 8443 for Tomcat or Jenkins servers which do

not run as root, to lower numbered ports that require system

privileges, such as port 443.



* http://serverfault.com/questions/252150/port-forwarding-on-linux-without-iptables





> secondly,

> you can use ssh tunnel and tunnel your ssh session through your host to your

> guest very quickly

>

> from your laptop (this assumes both sshd daemons on guest and host use 22

> port)

>

> ssh -L 22222:IP-of-guest-virt-machine:22  user@IP-of-host-machine

>

> this establishes the ssh tunnel

>

> next goes:

> ssh user@localhost -p 22222

>

> you should get the pw prompt from guest machine

>

> check, if your host machine forwards packets in /etc/sysctl.conf

> net.ipv4.ip_forward = 1

>

>

> cheers,



This looks right. I also admit that I've taken to avoiding

host-specific firewall configurations because many of the tools to

manipulate firewalls overwrite or conflict with each other and wind up

completely screwing up the overall configuration.