From libvirt documentation:
By default, guests that are connected via a virtual network with can make any outgoing network connection they like. Incoming connections are allowed from the host, and from other guests connected to the same libvirt network, but all other incoming connections are blocked by iptables rules.
But I want guests to able to accept incoming connection from "outside".
The problem are these iptables rules that are set up automatically by libvirt:
*filter :INPUT DROP [22:4523] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [606:91824] ... -A FORWARD -d 192.168.122.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT -A FORWARD -i virbr0 -o virbr0 -j ACCEPT -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
How can I configure libvirt to include state
NEW in the first
FORWARD rule? Or to get rid of the reject rules or something similar.
I know I can add such rule to iptables manually myself, but I'm curious if it can be done just by changing libvirt configuration. I have access to one server where it is already configured in such way, but I couldn't find how (even by diffing
I'm using libvirt 1.2.9-9+deb8u2 on Debian 8.5 Jessie. I use the
$ sudo virsh net-list Name State Autostart Persistent ---------------------------------------------------------- default active yes yes $ sudo virsh net-dumpxml default <network connections='6'> <name>default</name> <uuid>aafc9c08-98b2-499c-9058-8eb6fce47ab6</uuid> <forward mode='nat'> <nat> <port start='1024' end='65535'/> </nat> </forward> <bridge name='virbr0' stp='on' delay='0'/> <ip address='192.168.122.1' netmask='255.255.255.0'> <dhcp> <range start='192.168.122.2' end='192.168.122.254'/> </dhcp> </ip> </network>