Wiki - https://fedoraproject.org/wiki/Changes/LibvirtNetworkFilterNFTables Discourse poll - https://discussion.fedoraproject.org/t/f46-change-proposal-libvirt-network-filter-nftables-self-contained/204726/2
This is a proposed Change for Fedora Linux. This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee. == Summary == The default firewall backend for the libvirt network filter (the virtnwfiltered daemon), will change from '<code>iptables</code>' to '<code>nftables</code>'. == Owner == * Name: [[User:berrange| Daniel P. Berrangé]] * Email: [email protected] == Detailed Description == Libvirt provides a network filtering service, which allows firewall rules to be associated with guest network devices. This can be used to prevent the guest from doing MAC/IP spoofing and other malicious traffic. Historically this filtering has been implemented using the 'iptables', 'ip6tables' and 'ebtables' commands. Libvirt has now been enhanced to support use of the NFTables userspace via the 'nft' command. The libvirt virtual network firewall rules were [[Changes/LibvirtVirtualNetworkNFTables|previously switched to NFTables in Fedora 41]], and this change brings the networking filtering feature into alignment, removing all usage of the legacy firewall userspace from libvirt. == Feedback == TBD == Benefit to Fedora == * All libvirt's interaction with the host firewall is directly managed using nft, instead of legacy userspace shims * The nft backend for networking filtering offers greater performance / scalability when large numbers of VMs run on a host == Scope == * Proposal owners: Update libvirt to release 12.8.0 [✅ libvirt-12.8.0-1.fc46] * Other developers: n/a * Release engineering: n/a * Policies and guidelines: n/a * Trademark approval: n/a * Alignment with the Fedora Strategy: n/a == Upgrade/compatibility impact == If a host currently using libvirt's iptables/ebtables backend for firewalls is upgraded to Fedora 44, all VMs launched from that point onwards will automatically switch to use of nft. If a user has a reason to revert back to the original implementation, they can do so by changing the "firewall_backend" setting in "<code>/etc/libvirt/nwfilter.conf</code>" == Early Testing (Optional) == n/a == How To Test == Take a libvirt virtual machine XML config and add the "clean-traffic" filter to its network interface(s), for example, a typical config would look like: <interface type="network"> <mac address="52:54:00:cb:2c:b4"/> <source network="default"/> <model type="virtio"/> <filterref filter="clean-traffic"/> <address type="pci" domain="0x0000" bus="0x01" slot="0x00" function="0x0"/> </interface> NB. PCI and MAC address will differ per guest/NIC. Boot the guest as normal, and its NIC should acquire a IP address from DHCP server as usual "<code>nft list ruleset</code>" should report existence of "<code>libvirt_nwfilter_ethernet</code>" and "<code>libvirt_nwfilter_inet</code>" tables == User Experience == The change generally ought to be transparent to users, as it is automatically switching the firewall backend behind the scenes and is compatible across the upgrade. If a user has a reason to revert back to the original implementation, they can do so by changing the "firewall_backend" setting in "<code>/etc/libvirt/nwfilter.conf</code>" == Dependencies == N/a == Contingency Plan == * Contingency mechanism: n/a. The change is already complete in F46 rawhide * Contingency deadline: n/a * Blocks release? n/a == Documentation == * [https://libvirt.org/formatnwfilter.html Libvirt network filter config guide] == Release Notes == The libvirt network filter implementation has been switched to use NFTables by default. -- Aoife Moloney Fedora Operations Architect Fedora Project Matrix: @amoloney:fedora.im IRC: amoloney -- _______________________________________________ devel-announce mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
