Hi,
I just set up a new KVM Server, everything seems to work, but prerouting to
guests.
I created a guest (192.168.121.2) (which I can access via virt-manager), where
I want to route my SSH traffic to. Its using the default network.
I created a prerouting and postrouting chain in my nftables.conf.
172.18.68.11 is the KVM supervisor, and 192.168.121.0/24 is its guest network.
virbr0 is the guest network and bond0 is the supervisor network.
When I only load the rules in nftables everything works fine, but when I
restart libvirtd then (thus loading the default rules in such as the
libvirt_network table) the forwarding failes with ssh: connect to host
172.18.68.11 port 22: Connection refused.
When I delete the forward chain in the default libvirt_network rules everything
works again.
The foward chain consists of """
chain forward { # handle 33
type filter hook forward priority filter; policy accept;
counter packets 9 bytes 500 jump guest_cross # handle 36
counter packets 9 bytes 500 jump guest_input # handle 35
counter packets 0 bytes 0 jump guest_output # handle 34
}
"""
Can someone have a look at my ruleset?
https://bin.disroot.org/?5924a197c67e0016#362YmVtB8bjehtLVZb8Qf856VxMJR14UUSBav3AAHGQq
(up until table libvirt_network its my nftables.conf, under that its the rules
that get loaded in with the libvirtd daemon)
Am I doing something wrong, when I create a new prerouting chain?
