QEMU Windows guest without internet but with a shared folder

firewallnetworkingqemu

I'm setting up a Debian machine running a Windows 7 guest in a qemu/kvm virtualization stack. Since the Windows machine is running out-dated software, I decided to put it into a VM without Internet access. However, I need to get files in and out of the VM.

I heard that it's possible to set up a host-only network and change the firewall rules in order to prohibit all accesses but to the host machine. The host however needs full Internet access.

I have no experience with firewall configuration under Linux. How can I achieve the goal described above?

Best Answer

This should do it:

$ qemu-system-x86_64 -net nic -net user,restrict=on,smb=/path/to/shared/folder ...

From the manpage:

-netdev user,id=id[,option][,option][,...]
-net user[,option][,option][,...]
    Use the user mode network stack which requires no administrator
    privilege to run. Valid options are:
    ...
    restrict=on|off
        If this option is enabled, the guest will be isolated, i.e. it
        will not be able to contact the host and no guest IP packets
        will be routed over the host to the outside. This option does
        not affect any explicitly set forwarding rules.
    ...              
    smb=dir[,smbserver=addr]
        When using the user mode network stack, activate a built-in SMB
        server so that Windows OSes can access to the host files in dir
        transparently. The IP address of the SMB server can be set to
        addr. By default the 4th IP in the guest network is used, i.e.
        x.x.x.4.
        In the guest Windows OS, the line:
                10.0.2.4 smbserver
        must be added in the file C:\WINDOWS\LMHOSTS (for windows
        9x/Me) or C:\WINNT\SYSTEM32\DRIVERS\ETC\LMHOSTS (Windows
        NT/2000).
        Then dir can be accessed in \\smbserver\qemu.
        Note that a SAMBA server must be installed on the host OS.
        QEMU was tested successfully with smbd versions from Red Hat 9,
        Fedora Core 3 and OpenSUSE 11.x.

For this to work, samba must be installed on the host system; it doesn't need to be configured or running, just the smbd binary is needed, which will be run with an ad-hoc configuration and no privileges.

Note

In windows 7, you can connect to the shared folder from Computer -> Add Network Location -> Choose a custom network location -> \\10.0.2.4\qemu.

If windows insists on opening the "Connect to the Internet" wizard, then just close it; the "Add Network Location" wizard is still running, and you can reopen its window by clicking on the taskbar icon.

Related Question