virtualbox.org

Hello all,

New to the forum, so bear with me here. I have searched for my query but have not been able to find an answer, so here it goes.

I have a WinXP guest OS on a Win 7 (64-bit) host OS. VirtualBox is 4.2.16.

I have a service running on the guest OS on an arbitrary high tcp port which I want to access from the host OS. The vm has the default Networking configuration: NAT. I have added Port Forwarding in the Advanced section of the UI, and it works just fine to allow access from host OS to the guest OS's high port.

The port forwarding configuration I added is as follows:

Name: Some name
Protocol: TCP
Host IP: [blank]
Host Port: 50000
Guest IP: [blank]
Guest Port: 50000

With this, if I telnet to localhost port 50000 on the host OS I do see what I expect to see, with the service on the guest OS providing the expected response.

I have left the Guest IP blank per the VirtualBox documentation, which states that if your vm is obtaining an IP address off of the built-in DHCP server, no specific IP address needs be stated.

I have left the Host IP blank following one of the samples I saw, but I understand that this means that packets directed to the host OS's port 50000/tcp will be forwarded to the guest OS regardless of the source IP address, i.e. not just those packets originating from the host OS will be forwarded to the guest OS.

Now I want to restrict that, for security reasons, only allowing the port forwarding feature to forward traffic originating from the host OS, and not from other devices on the network.

The machine (laptop) all this is set up on has only two IP addresses: one obtained from my home WLAN network (wireless driver), and one from the VirtualBox network.

I have tried listing each of them in the Host IP field of the port forwarding config, in the hope that my host-OS-generated traffic would still go through to the guest OS, and no other traffic would... but now the service is not reachable anymore.

Am I doing something wrong? Am I interpreting the Host IP in the port forwarding configuration wrong? Should I maybe assign an IP address to the LAN NIC (unused) and go with that?

Any insight will be much appreciated. Sorry if this ended up being a bit long, just wanted to provide enough background.

Thanks,
Santiago

NAT is not really the proper network mode then.
On the other hand, Host-Only is. You want to restrict access to the host-only yes? Then the question gives you the answer.

Thanks for the reply, noteirak.

Unfortunately, Host-only mode is not an option for me since I need the guest to access the outside world (sorry, hadn't stated that in my original post). And I understand Host-only mode does not allow vm's to do that.

That said... any recommendations on tampering with the Host IP field of the port forwarding config? Or on why my attempt did not work? I'm thinking it acts like a filter, and only traffic that matches the filter will actually be forwarded... or am I wrong?

Thanks for the assist,
Santiago

You can give 2 adapters to your VM then :
- NAT for the outside world communication like a regular client
- Host-Only for the server part to the host

I hadn't thought about a dual adapter approach. Not a bad idea!

I'm still puzzled why my intended "filtering" won't work, but your approach should provide me with the security I'm striving for. I guess I'll drop the outstanding questions, then.

Thanks for the help, noteirak!