How to disable portforwarding completely

[Ranjandas]

I use socket_vmnet and would like to turn off port-forwarding, mounts, and containerd completely (like the --plain mode).

I don't want to use --plain because I found that only the provision scripts that run as mode: system sees the environment variables I pass using .env.

The mode: user scripts don't have access to the environment variables, and even when I log into the VM's the environment variables don't show up (i.e, the /etc/environment is empty).

Is this expected? How do I get the effect similar to --plain but retain the environment variables?

I tried setting portForwards to an empty list (portForwards: []), but I can see the hostAgent trying to portforward.

WARN[0037] [hostagent] failed to set up forwarding tcp port 4646 (negligible if already forwarded)  error="failed to run [ssh -F /dev/null -o IdentityFile=\"/Users/ranjan/.lima/_config/user\" -o IdentityFile=\"/Users/ranjan/.ssh/id_rsa\" -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o NoHostAuthenticationForLocalhost=yes -o GSSAPIAuthentication=no -o PreferredAuthentications=publickey -o Compression=no -o BatchMode=yes -o IdentitiesOnly=yes -o Ciphers=\"^aes128-gcm@openssh.com,aes256-gcm@openssh.com\" -o User=ranjan -o ControlMaster=auto -o ControlPath=\"/Users/ranjan/.lima/murphy-cli-01/ssh.sock\" -o ControlPersist=yes -T -O forward -L 127.0.0.1:4646:[::]:4646 -N -f -p 63203 127.0.0.1 --]: \"\": exit status 255"

[jandubois]

I would try

portForwards:
- ignore: true

I think the defaults should work correctly. Otherwise try

portForwards:
- ignore: true
  guestIP: 127.0.0.1
  guestPortRange: [1, 65535]

Port 22 will always be forwarded.

[Ranjandas]

@jandubois, Thank you. I tried both options, but they didn't work.

[suspenss]

same issue，Have you solved this problem？

[jandubois]

Maybe try guestIP: 0.0.0.0 instead to disable forwarding from all interfaces

[nirs]

With 1.0.0 beta.0 you can use:

portForwards:
- ignore: true
  proto: any

[RafalSkolasinski]

I just tried with 1.0.1 and just

portForwards:
- ignore: true

worked for me.

Would be nice if it made its way to documentation.
Also a dedicated CLI flag like for --network=vzNAT would be nice.

[jandubois]

Just in case anybody comes here later, the correct way to disable all portforwards in Lima 1.0 and later is

portForwards:
- ignore: true
  proto: any
  guestIP: 0.0.0.0

The proto: any part is not supported in older Lima versions, but those didn't forward UDP anyways, so the default of tcp was good enough.

[mjakl]

Just in case anybody comes here later, the correct way to disable all portforwards in Lima 1.0 and later is

portForwards:
- ignore: true
  proto: any
  guestIP: 0.0.0.0

The proto: any part is not supported in older Lima versions, but those didn't forward UDP anyways, so the default of tcp was good enough.

I had to use the following to disable port forwarding in Lima 2.0.x:

portForwards:
- ignore: true
  proto: any
  guestIP: 127.0.0.1

Using guestIP: 0.0.0.0 kept auto-forwarding.

What I like to do, is to only forward ports that have been opened on 0.0.0.0 explicitly, not the ones that bound to 127.0.0.1 only:

## Auto forward only ports bound to 0.0.0.0 (not 127.0.0.1):
portForwards:
  # Allow only ports bound to 0.0.0.0
  - guestIP: "0.0.0.0"
    guestIPMustBeZero: true # required for “only 0.0.0.0”
    proto: any
    guestPortRange: [1, 65535]
  # Block localhost-only listeners
  - guestIP: "127.0.0.1"
    proto: any
    guestPortRange: [1, 65535]
    ignore: true

[jandubois]

I had to use the following to disable port forwarding in Lima 2.0.x:

The reason is that the default for guestIPMustBeZero in Lima 2.x defaults to true. It defaulted to false in Lima 1.x: #4221