I set up a bridge
br0 "attached" to two interfaces:
eth0, my physical interface connected to the real LAN,
vnet0, a KVM virtual interface (connected to a Windows VM).
And I have this single firewall rule in the forward chain:
iptables -A FORWARD -j REJECT
Now, the only ping that is working is from the VM to the host.
br0 interface owns the IP address of my host machine.
vnet0 do not "own" any IP, from the host point of view. The Windows VM has a static IP configuration.
If change my
iptables rule to
ACCEPT (or even use a more restrictive
iptables -A FORWARD -o br0 -j ACCEPT), everything is working fine! (i.e. I can ping any LAN machine from the VM, and the other way round too).
All IP forwarding kernel options are disabled (like
net.ipv4.ip_forward = 0).
So, how can the netfilter firewall block something that is not even enabled?
Furthermore, the VM - LAN traffic should only imply
vnet0. Yet it looks like allowing FORWARD traffic with
-o br0 "works" (I did not check very carefully though).