Troubleshooting nested virtualization

This document describes common errors that you may run into when using nested virtualization and methods for resolving those errors. For more information about nested virtualization, see Creating nested VMs .

Can't start nested VM

If your project is part of an organization, your organization might have disabled the ability to create VMs with nested virtualization. Make sure that nested virtualization is allowed before you try to create a VM that has nested virtualization enabled.

Processor not displaying nested virtualization

If the grep -c vmx /proc/cpuinfo command returns 0 and reports that the VM isn't enabled for nesting, make sure of the following:

You started your VM with a CPU platform of Intel Haswell or later. For more information, see Nested virtualization overview .
The machine series used to create the VM supports nested virtualization. For more information, see Machine type comparison .
Your project or organization's policy constraints allow nested virtualization. If policy constraints disallow nested virtualization, the CPU won't expose nesting capabilities. For more information, see Checking whether nested virtualization is allowed .

Can't exit nested VM

If you did not run screen before each nested VM session, you can either shut down the nested VM or stop the process from another terminal. To shut down the nested VM, run the poweroff command from within your nested VM. Alternatively, log into the host VM in another terminal and end the process, then run screen on the host VM before you start a new nested VM.

`iptables` not forwarding traffic

iptables resolve rules from top to bottom. Make sure your rules are higher priority than other rules.
Check that there are no conflicting rules intercepting your packets.
Consider flushing your iptables :

Note: Flushing iptables disables your firewall. You should only do this if you want to start over configuring your firewall.
1. First, set the default policies:
```
 sudo iptables -P INPUT ACCEPT
sudo iptables -P FORWARD ACCEPT
sudo iptables -P OUTPUT ACCEPT 
```
2. Next, flush all tables and chains, and delete non-default chains:
```
 sudo iptables -t nat -F
sudo iptables -t mangle -F
sudo iptables -F
sudo iptables -X 
```