thanks to this excellent script it is now possible to nat-port forward multiple ports from:


thanks & great work all invovled 🙂

here is the script: etc_libvirt_hooks_qemu.txt

in NAT mode, the host firewall stands between the wild wild west inet and the guest vm.

in order to allow certain ports through (webserver: 80/443), a bit of config hazzle has to be done.

note: this article is a result of “quick note taking” process and is not of the quality, one would like to see and will have to be refined further, follow the instructions to install the script.

just ignore the rest and study the manual here:

and the user should have no problems getting port-nat-forwarding to work 🙂

  1. give vm a fixed ip
    • this needs to be configured inside the vm, to not use dhcp but stick with a static ip
    • plus: via “virsh net-edit default” tell kvm that this vm will use that fixed ip
# how to nat host-port pass-through to kvm guest-vm

  1. download
  2. unzip
  3. copy into place
    • mv -v qemu-hook-script /etc/libvirt/hooks/qemu
#===== KVM virsh documentation =====
#ip of server
#ipv4: public.ip.of.server
# find mac and ip of vm
virsh dumpxml webserver3 | grep -i '<mac'
<mac address='52:54:00:4e:51:cf'/>

<host mac='52:54:00:4e:51:cf' name='webserver3' ip=''/>

virsh net-dhcp-leases default

Expiry Time MAC address Protocol IP address Hostname Client ID or DUID
2021-08-06 11:34:37 52:54:00:4e:51:cf ipv4 webserver3 ff:00:4e:51:cf:00:01:00:01:28:9a:76:3d:52:54:00:11:c1:e0

# inside vm: create test index.html page
echo "<h1>hello world</h1>" > /home/user/web/

asign fixed ip to vm:

# inside vm:
vim /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
# allow-hotplug enp1s0
# iface enp1s0 inet dhcp
auto enp1s0
iface enp1s0 inet static

# on kvm-host-sever: edit the kvm networking config file
# to announce that those VMs will use a fixed ip
virsh net-edit default
<forward mode='nat'/>
<bridge name='virbr0' stp='on' delay='0'/>
<mac address='52:54:00:eb:93:ad'/>
<ip address='' netmask=''>
<range start='' end=''/>
   <host mac='52:54:00:4e:51:cf' name='vm1' ip=''/>
   <host mac='52:54:00:52:3e:f6' name='vm2' ip=''/>
   <host mac='52:54:00:b0:7b:b9' name='vm3' ip=''/>
# restart the virtual networking / to make changes active
virsh net-destroy default; virsh net-start default;