qemu resolve domain problem

smurfd

hey,
before i pull my hair out, i need to ask for help.
I never bothered to create a separate network for my qemu vm's so instead just used 192.168.0.x as ip addresses for my vms, the same as my hosts... lazy and easy. But works.
Thought i would fix this, and create a 192.168.6.x for vm's. Have read: https://netbsd.org/docs/guide/en/chap-virt.html
NetBSD v11 as Guest and Host v10.1 stable.

Almost everything works from guest:
pinging bridge ip 192.168.6.1
pinging router ip: 192.168.0.1
pinging external ip: 8.8.8.8
What does not work from guest:
it takes about 30sek before responding. have read 30.4.2 from above link
Does not resolve domains, probably because of timeout.
npf on host, if i disable it, it wont work, but fails quickly.

$ cat /etc/npf.conf 
$wired_if = "re0"
$wired_addrs= ifaddrs($wired_if)
alg "icmp"
map $wired_if dynamic { 192.168.6.0/24 } -> inet4($wired_if)

procedure "log" {
    log: npflog0
}
group "wired" on $wired_if {
    ruleset "blacklistd"
    pass stateful in on $wired_if proto tcp to $wired_addrs port ssh apply "log"
    pass stateful in on $wired_if proto tcp to $wired_addrs port 5900 apply "log"
    pass stateful in on $wired_if proto tcp to $wired_addrs port 5901 apply "log"
    pass stateful in on $wired_if proto tcp to $wired_addrs port 5905 apply "log"

    pass stateful out final proto tcp all
    pass stateful out final proto udp all
    pass stateful out final proto icmp all
    pass stateful out final proto ipv6-icmp all
    pass stateful out all
}
group default {
    block all apply "log"
    pass on lo0 all
    pass in family inet4 proto udp from any port bootps to any port bootpc
    pass in family inet4 proto icmp icmp-type echo all
    pass in proto udp to any port 33434-33600
    pass in proto udp to any port mdns
    pass stateful out all
}

host /etc/rc.conf

auto_ifconfig=NO
net_interfaces="re0 tap0 tap1"
hostname=meathook.island.smurfd.me
defaultroute=192.168.0.1
clear_tmp=YES
random_seed=YES
random_file=/etc/entropy-file
wscons=NO
sshd=YES
modules=YES
npf=YES
securelevel=0
gateway_enable="YES"

host /etc/ifconfig.tap0

create
inet 192.168.6.1 netmask 255.255.255.0
descr "NetBSD VM" up
!ifconfig bridge0 create
!ifconfig bridge0 descr "LAN VM bridge"
!brconfig bridge0 add re0 add tap0 up

host /etc/sysctl.conf

net.inet.ip.forwarding=1

host /etc/resolv.conf

nameserver 192.168.0.1

guest /etc/rc.conf

hostname=netvm.vm.smurfd.me
defaultroute=192.168.6.1
wscons=YES
gateway_enable="YES"
ip6addrctl=YES
ip6addrctl_policy="ipv4_prefer"

guest /etc/sysctl.conf

net.inet.ip.forwarding=1

guest /etc/resolv.conf

nameserver 192.168.6.1

I know its something silly im doing wrong. Have also tried to set nameserver 0.1 in guest aswell...

thanks in advance!

smurfd

soo, guess i didn't read the manual. DOH.

Copy & pasted example from there and modified to my needs.
Works like a charm. Both problems solved. 🙂

$ext_if = { inet4(re0) }
$int_if = { inet4(tap0) }
table <blocklist> type ipset file "/etc/npf_blocklist"
table <limited> type lpm
$services_tcp = { domain, 5900, 5901, 5902, 5903, 5904, 5905 }
$services_udp = { domain, ntp }
$localnet = { 192.168.6.0/24 }
alg "icmp"
# These NAT rules will dynamically select the interface address(es).
map $ext_if dynamic 192.168.6.0/24 -> ifaddrs($ext_if)
procedure "log" {
   log: npflog0
}
group "external" on $ext_if {
  pass stateful out final all
  block in final from <blocklist>
  pass stateful in final family inet4 proto tcp to $ext_if port ssh apply "log" 
  pass stateful in final proto tcp to $ext_if port $services_tcp 
  pass stateful in final proto udp to $ext_if port $services_udp
}
group "internal" on $int_if {
  block in all
  block in final from <limited>
  pass in final from $localnet
  pass out final all
}
group default {
  pass final on lo0 all
  block all
}

Guest /etc/resolv.conf

search 192.168.0.1
nameserver 192.168.0.1

This is probably the line that made it work 😉
pass in final from $localnet