On Sat, Oct 25, 2025 at 10:23:07PM +0100, baleti wrote:
> Thanks for explaining David, that makes sense. I've added --no-map-gw to my
> setup and ended up forwarding diod using vsock and socat. Sorry are you
> saying that guest still has access to services listening on the host? Is
> there a way to block it and any other private IPs? I was trying to isolate
> the virtual machine as much as possible except for selected
> services.

Ah, ok.  --no-map-gw disables the defaults I was mentioning.  So with
that there's no (direct) way for the guest to reach services on the
host; or at least not via the address which is shared with the guest.
If the services are listening on multiple (non loopback) host
addresses, the guest can reach them via one of the other addresses.

At present there isn't a way to expose only certain host ports to the
guest.  We'd like to have the flexibility to do that (amongst many
other things), and we're working towards it. but it requires quite a
bit of infrastructure work.

In the meantime you have a few options:

 1) Remove --no-map-gw, and use the default NAT.  This does expose the
    host slightly, in the sense that the guest can connect to it in a
    way that appears to come from loopback, so that might not meat
    your isolation requirement.

 2) Use:
 	--map-guest-addr XXXX --map-host-loopback none
	(or equivalently --map-guest-addr XXXX --no-map-gw)
    This will let the guest access the host at address XXXX.  In a
    sense this does expose the host more than your current setup, but
    since connections via this NAT won't appear to come from loopback
    on the host (they'll appear to come from the host's public IP),
    you're not really exposing the host to the VM any more than it's
    already exposed to the outside world.

[Arguably, this should be the default behaviour; it's not for
 historical reasons]

 3) Change the guest address away from the default (which is the same
     as the host's address) with:
	-a YYYY --no-map-gw
    Now the guest will think it has address YYYY, and can access host
    services via the host's usual public address.  Again, those
    connections from the VM won't appear to come from loopback, so
    it's not exposing the host to the VM any more than it's exposed to
    the world.

> On 10/25/25 9:14 AM, David Gibson wrote:
> > On Sat, Oct 25, 2025 at 01:02:36AM +0100, baleti wrote:
> > > does anyone know if passt can port forward from guest to host? I'm trying to
> > > make a diod server available on the guest?
> > I'm assuming you're using passt (guest is a VM) not pasta (guest is a
> > container).
> > 
> > > on host I run a service listening on 9564:
> > >   ~ $ diod --foreground --listen 0.0.0.0:9564 --export
> > > /home/user/autocad-ballet --no-auth
> > > 
> > > is there a way for passt to make it available on the guest?
> > Yes, but you don't need an explicit forward for this - passt's default
> > behaviour is to let the guest access things outside, including the
> > host.  The complication is that, by default, the guest gets the same
> > address as the host, so the guest can't access the host using it's
> > normal address.
> > 
> > However, also by default, we remap the default gateway address to the
> > host.  That is, if on the guest you connect to the address of the
> > default gateway, port 9564, that will actually connect to diod on the
> > host.
> > 
> > The details of this can be adjusted with the --map-host-loopback,
> > --map-guest-addr and -no-map-gw options.
> > 
> _______________________________________________
> user mailing list -- passt-user@passt.top
> To unsubscribe send an email to passt-user-leave@passt.top

-- 
David Gibson (he or they)	| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you, not the other way
				| around.
http://www.ozlabs.org/~dgibson