This looks somewhat problematic if you do not have experience of advanced iptables manipulation and overview of how Linux filters traffic for local processes.
In your mode qemu runs an emulated NAT: all calls to NIC from guest will be translated as socket/connect/send/recv calls by qemu process itself. This means that connections are made by machine itself, from 127.0.0.1. At this point you can run qemu as another user, and filter that user by adding an
iptables -I OUTPUT -o lo -m owner --uid-owner username -m multiport --dports ports -j DROP
username is a name of user you want to filter and
ports is a comma separated list of ports you wish to disable for that machine. To run qemu as another user, you need to run it via tools like
sudo or logging in as the user with
Without this, you end up to filter yourself, so if you will add a general rule to filter ports, you will be blocked from accessing these ports as well.
Another way is to change the way qemu does networking. A good way to filter traffic well is to bind qemu to virtual ethernet device:
tunctl -u yourname -t qemu
(remember to add this command to something like
rc.local to make it permanent)
- Configure qemu interface (use
ifconfig or other OS provided tool) to assign a free /24 subnet to it. This subnet is needed to be set in your guest OS as well. Then run qemu with
-net tap,ifname=qemu,script=off. Configure guest OS networking again.
Then you can easily filter guest OS traffic which is represented by
qemu virtual interface:
iptables -I FORWARD -i qemu -m multiport --dports ports -j DROP
But the NAT stopped working. If you need to make NAT work again, you should add a rule that will patch IP addresses going out of your machine. If you have
eth0 interface where your all traffic goes, you enable NAT for it:
iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE