2

From libvirt documentation:

By default, guests that are connected via a virtual network with can make any outgoing network connection they like. Incoming connections are allowed from the host, and from other guests connected to the same libvirt network, but all other incoming connections are blocked by iptables rules.

But I want guests to able to accept incoming connection from "outside".

The problem are these iptables rules that are set up automatically by libvirt:

*filter
:INPUT DROP [22:4523]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [606:91824]
...
-A FORWARD -d 192.168.122.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
-A FORWARD -i virbr0 -o virbr0 -j ACCEPT
-A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable

How can I configure libvirt to include state NEW in the first FORWARD rule? Or to get rid of the reject rules or something similar.

I know I can add such rule to iptables manually myself, but I'm curious if it can be done just by changing libvirt configuration. I have access to one server where it is already configured in such way, but I couldn't find how (even by diffing /etc).


I'm using libvirt 1.2.9-9+deb8u2 on Debian 8.5 Jessie. I use the default network:

$ sudo virsh net-list
 Name                 State      Autostart     Persistent
----------------------------------------------------------
 default              active     yes           yes

$ sudo virsh net-dumpxml default
<network connections='6'>
  <name>default</name>
  <uuid>aafc9c08-98b2-499c-9058-8eb6fce47ab6</uuid>
  <forward mode='nat'>
    <nat>
      <port start='1024' end='65535'/>
    </nat>
  </forward>
  <bridge name='virbr0' stp='on' delay='0'/>
  <ip address='192.168.122.1' netmask='255.255.255.0'>
    <dhcp>
      <range start='192.168.122.2' end='192.168.122.254'/>
    </dhcp>
  </ip>
</network>
  • There are no iptables rules set up by libvirt on my Debian systems here. I'll see if I can identify a difference. – roaima Jul 2 '16 at 13:08
  • @roaima Answer updated. I guess libvirt manages iptables for any network (at least with forward mode="nat") managed by libvirt. – Messa Jul 2 '16 at 13:08
  • I guess so. (I don't think I've ever used the NAT network.) I will see if I can try it out later – roaima Jul 4 '16 at 18:36
2

If you want your guests to have full transparent access to the rest of your network, don't use the default NAT network. In my case I've disabled it too:

virsh net-list
Name                 State      Autostart
-----------------------------------------

In my /etc/network/interfaces I have a definition like this, which configures a bridge device br0 on my NIC eth0 that I can use for my guests:

########################################################################
# The network interface
# 192.168.1.0/24
#
#allow-hotplug eth0
iface eth0 inet manual

auto br0
iface br0 inet static
        address 192.168.1.253
        netmask 255.255.255.0
        gateway 192.168.1.254
        bridge_ports eth0
        bridge_fd 0
        bridge_maxwait 0

I can then specify this previously defined bridge as the shared device when defining a guest:

virsh dumpxml myguest
    ...
    <interface type='bridge'>
      <mac address='52:54:00:3c:75:30'/>
      <source bridge='br0'/>
      <target dev='vnet5'/>
      <model type='virtio'/>
      <alias name='net0'/>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x0b' function='0x0'/>
    </interface>
    ...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.