2013/7/8 Sven Schwedas <sven.schwe...@tao.at> > Hi, > > I'm trying to configure nwfilter for KVM, but so far I haven't managed > to figure out a working configuration. > > Network setup: The dom0 (Debian 7.1, kernel 3.2.46-1, libvirt 0.9.12) is > connected via eth0, part of the external subnet 192.168.17.0/24, and has > an additional subnet 192.168.128.160/28 routed to its main address > 192.168.17.125. > > The host's subnet is configured as bridge in virsh: > > <network> > > <name>foo</name> > > <forward dev='eth0' mode='route'> > > <interface dev='eth0'/> > > </forward> > > <bridge name='foo-br0' stp='off' delay='0' /> > > <ip address='192.168.128.161' netmask='255.255.255.240'> > > </ip> > > </network> > > The domU is configured to use this bridge (static IP configured in DomU): > > > <interface type='network'> > > <source network='foo'/> > > <target dev='vnet0'/> > > <model type='virtio'/> > > <filterref filter='test-eth0'> > > <parameter name='CTRL_IP_LEARNING' value='none'/> > > <parameter name='IP' value='192.168.128.162'/> > > </filterref> > > <alias name='net0'/> > > <address type='pci' domain='0x0000' bus='0x00' slot='0x03' > function='0x0'/> > > </interface> > > With an empty filter, connectivity is working fine. Now, if I add the > example ruleset suggested in the documentation ( > http://libvirt.org/formatnwfilter.html#nwfwriteexample ), *incoming* > ICMP works (but not outgoing), and inbound SSH traffic is blocked, > together with outbound DNS. > > The linked rules produce the following iptables chains: > > > Chain INPUT (policy ACCEPT) > > target prot opt source destination > > libvirt-host-in all -- 0.0.0.0/0 0.0.0.0/0 > > ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:53 > > ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 > > ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:67 > > ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:67 > > > > Chain FORWARD (policy ACCEPT) > > target prot opt source destination > > libvirt-in all -- 0.0.0.0/0 0.0.0.0/0 > > libvirt-out all -- 0.0.0.0/0 0.0.0.0/0 > > libvirt-in-post all -- 0.0.0.0/0 0.0.0.0/0 > > ACCEPT all -- 0.0.0.0/0 192.168.128.160/28 > > ACCEPT all -- 192.168.128.160/28 0.0.0.0/0 > > ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 > > REJECT all -- 0.0.0.0/0 0.0.0.0/0 > reject-with icmp-port-unreachable > > REJECT all -- 0.0.0.0/0 0.0.0.0/0 > reject-with icmp-port-unreachable > > > > Chain OUTPUT (policy ACCEPT) > > target prot opt source destination > > > > Chain FI-vnet0 (1 references) > > target prot opt source destination > > RETURN tcp -- 0.0.0.0/0 0.0.0.0/0 tcp > spt:22 state ESTABLISHED ctdir ORIGINAL > > RETURN tcp -- 0.0.0.0/0 0.0.0.0/0 tcp > spt:80 state ESTABLISHED ctdir ORIGINAL > > RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 state > NEW,ESTABLISHED ctdir REPLY > > RETURN udp -- 0.0.0.0/0 0.0.0.0/0 udp > dpt:53 state NEW,ESTABLISHED ctdir REPLY > > DROP all -- 0.0.0.0/0 0.0.0.0/0 > > > > Chain FO-vnet0 (1 references) > > target prot opt source destination > > ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp > dpt:22 state NEW,ESTABLISHED ctdir REPLY > > ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp > dpt:80 state NEW,ESTABLISHED ctdir REPLY > > ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state > ESTABLISHED ctdir ORIGINAL > > ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp > spt:53 state ESTABLISHED ctdir ORIGINAL > > DROP all -- 0.0.0.0/0 0.0.0.0/0 > > > > Chain HI-vnet0 (1 references) > > target prot opt source destination > > RETURN tcp -- 0.0.0.0/0 0.0.0.0/0 tcp > spt:22 state ESTABLISHED ctdir ORIGINAL > > RETURN tcp -- 0.0.0.0/0 0.0.0.0/0 tcp > spt:80 state ESTABLISHED ctdir ORIGINAL > > RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 state > NEW,ESTABLISHED ctdir REPLY > > RETURN udp -- 0.0.0.0/0 0.0.0.0/0 udp > dpt:53 state NEW,ESTABLISHED ctdir REPLY > > DROP all -- 0.0.0.0/0 0.0.0.0/0 > > > > Chain libvirt-host-in (1 references) > > target prot opt source destination > > HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] > PHYSDEV match --physdev-in vnet0 > > > > Chain libvirt-in (1 references) > > target prot opt source destination > > FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] > PHYSDEV match --physdev-in vnet0 > > > > Chain libvirt-in-post (1 references) > > target prot opt source destination > > ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV > match --physdev-in vnet0 > > > > Chain libvirt-out (1 references) > > target prot opt source destination > > FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] > PHYSDEV match --physdev-out vnet0 > > I've tried fidgeting with the configuration (direction inout instead of > in/out, etc.), but I didn't find a setup that works as intended. What am > I missing?
I always use ebtables instead of iptables and everything works fine for me. ebtables works with mac stp vlan arp rarp ipv4 ipv6 , tcp udp works with iptables.
_______________________________________________ libvirt-users mailing list libvirt-users@redhat.com https://www.redhat.com/mailman/listinfo/libvirt-users
