Virtual Machine

[J65nko]

At this moment I am installing OpenBSD 6.5 in a VM on OpenBSD 6.4-stable. Just followed the directions in https://www.openbsd.org/faq/faq16.html

I was using bsd.rd only to boot the VM with. Initially the install program could not download the installation file sets because I forgot 2 things which are clearly described under :Option 2 - NAT for the VMs:

1. Enable IP forwarding
   First manually to prevent rebooting ....:
   

   hp_server# sysctl net.inet.ip.forwarding=1
   net.inet.ip.forwarding: 0 -> 1

   Then modify /etc/sysctl.conf
   

   hp_server# cat /etc/sysctl.conf
   machdep.allowaperture=1
   net.inet.ip.forwarding=1

2. Modify my workstation pf.conf to allow NAT for the 100.64.0.0/10 shared address space:
   

   dns_server = '8.8.8.8'
   match out on egress from 100.64.0.0/10 to any nat-to (egress)
   pass in proto { udp tcp } from 100.64.0.0/10 to any port domain \
           rdr-to $dns_server port domain

In the mean time that I write this the sets have been downloaded and installed ....

Get/Verify SHA256.sig   100% |**************************|  2141       00:00    
Signature Verified
Get/Verify bsd          100% |**************************| 15163 KB    00:38    
Get/Verify bsd.rd       100% |**************************|  9984 KB    00:30    
Get/Verify base65.tgz   100% |**************************|   190 MB    10:34    
Get/Verify comp65.tgz   100% |**************************| 71916 KB    02:53    
Get/Verify man65.tgz    100% |**************************|  7385 KB    00:17    
Installing bsd          100% |**************************| 15163 KB    00:00    
Installing bsd.rd       100% |**************************|  9984 KB    00:00    
Installing base65.tgz   100% |**************************|   190 MB    00:30    
Extracting etc.tgz      100% |**************************|   260 KB    00:00    
Installing comp65.tgz   100% |**************************| 71916 KB    00:33    
Installing man65.tgz    100% |**************************|  7385 KB    00:03    
Location of sets? (disk http or 'done') [done]

[Head_on_a_Stick]

Originally Posted by J65nko

pass in proto { udp tcp } from 100.64.0.0/10 to any port domain \
        rdr-to $dns_server port domain

^ You don't need this line to let the VM use Google's DNS, it already has access to the interweb in general from the preceding line.

I have Arch & Debian VM's running that ask Quad9 for addresses and they work without that line (and connect with systemd-networkd, which is amusing).

[J65nko]

In my VM I have:

vm_j65# cat /etc/resolv.conf
# Generated by vio0 dhclient
nameserver 100.64.1.2
lookup file bind

To see whether you are right I commented out that second line, but after I reloaded the rules of my desktop hosting the VM, the VM could not resolve anymore:

vm_j65# dig www.google.com          

; <<>> DiG 9.4.2-P2 <<>> www.google.com
;; global options:  printcmd
;; connection timed out; no servers could be reached

However if I specify a name server it does:

vm_j65# dig www.google.com @8.8.8.8

; <<>> DiG 9.4.2-P2 <<>> www.google.com @8.8.8.8
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10672
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.google.com.                        IN      A

;; ANSWER SECTION:
www.google.com.         6       IN      A       172.217.168.228

;; Query time: 10 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Tue May  7 22:47:59 2019
;; MSG SIZE  rcvd: 48

So I think I really need that line .....
You may not need it because, I assume, you speifically configured your VMs to use the Quad9 name servers instead of the default OpenBSD VM on 100.64.1.2 that I have.

[jggimi]

I use rebound(8) to provide DNS services to my guests. It makes for a very simple pf.conf:

# NAT any virtual machines
match out on egress from 100.64.0.0/10 to any nat-to (egress)

pass log all

# route domain requests from virtual machines to rebound(8)
pass in log proto udp from 100.64.0.0/10 to (self) port domain rdr-to localhost

[Head_on_a_Stick]

Originally Posted by J65nko

You may not need it because, I assume, you speifically configured your VMs to use the Quad9 name servers instead of the default OpenBSD VM on 100.64.1.2 that I have.

Yes, that's right.

But why not just configure your VM to use 8.8.8.8 directly?

# /etc/dhclient.conf
supersede domain-name-servers 8.8.8.8;

[jggimi]

Originally Posted by Head_on_a_Stick

But why not just configure your VM to use 8.8.8.8 directly?

In my case, because I want the guests to be able to resolve local names from local unbound(8) nameservers.

[J65nko]

This was my first attempt to run an OpenBSD VM. And I told it to boot the 6.5 bsd.rd installer. Because the install got stuck at downloading the installation file sets, exactly following the FAQ's suggestion to modify the firewall rules seemed to be the fastest was to get the install going again ;-)

# vmctl start "OpenBSD_65" -b /home/adriaan/Downloads/bsd.rd \
-m 1G -L -c -i1--d//home2/vm_disk

[J65nko]

Originally Posted by jggimi

I use rebound(8) to provide DNS services to my guests. It makes for a very simple pf.conf:

[trim]
# route domain requests from virtual machines to rebound(8)
pass in log proto udp from 100.64.0.0/10 to (self) port domain rdr-to localhost

Name servers uses UDP by default but in some cases they switch to TCP. So IMHO your rule should be :

# route domain requests from virtual machines to rebound(8)
pass in log proto { udp, tcp} from 100.64.0.0/10 to (self) port domain \
           rdr-to localhost

[jggimi]

You're right. I don't do zone transfers, so haven't had any trouble, but any request or response over 512 bytes will use TCP.