1

I have a VM using the default QEMU/KVM virtual network NAT adapter. Host is running Ubuntu Desktop 20.04. Guest is running Windows 10. I have setup a simple libvirt filter to block access to my Local Area Network so the guest cannot see it:

cat > no-localnet <<EOF
<filter name='no-localnet' chain='ipv4' priority='-700'>
<uuid>f49bd8c5-80ed-4f20-9132-27d3391bf3dc</uuid>
<rule action='drop' direction='out' priority='500'>
<all dstipaddr='192.168.0.0' dstipmask='16' comment='reject localnet out'/>
</rule>
<rule action='drop' direction='in' priority='500'>
<all srcipaddr='192.168.0.0' srcipmask='16' comment='reject localnet in'/>
</rule>
</filter>
EOF
virsh nwfilter-define no-localnet

Also added to the VM NIC xml settings:

<interface type="network">
  ...
  <filterref filter="no-localnet"/>
  ...
</interface>

The filter worked the first time I added it, but after rebooting the Host, it never worked again, no matter what I change.

3
  • Please clarify what happens instead.
    – Alex
    Nov 5, 2020 at 20:17
  • @Alex How it should work is to drop any network packets sent or received on the LAN (192.168.0.0/16), but it is not working at all, I can ping and access the network devices freely, but the first time when I applied the filter, it worked, the VM could not ping or access any devices on my Local Area Network, then after a host reboot, it never worked again
    – Fred
    Nov 6, 2020 at 10:09
  • I would like to add that I have reinstalled libvirt + kvm/qemu with the same result, no success.
    – Fred
    Nov 6, 2020 at 15:36

1 Answer 1

0

Found a workaround using IPTables

sudo iptables -I INPUT -d 192.168.100.0/24 -s 192.168.0.0/16 -j DROP
sudo iptables -I INPUT -s 192.168.100.0/24 -d 192.168.0.0/16 -j DROP
sudo iptables -I OUTPUT -d 192.168.100.0/24 -s 192.168.0.0/16 -j DROP
sudo iptables -I OUTPUT -s 192.168.100.0/24 -d 192.168.0.0/16 -j DROP
sudo iptables -I FORWARD -d 192.168.100.0/24 -s 192.168.0.0/16 -j DROP
sudo iptables -I FORWARD -s 192.168.100.0/24 -d 192.168.0.0/16 -j DROP

where 192.168.100.0/24 would be the range of IP's you want to block from accessing the local area network, in this case, the ones assigned to the VM. Note: these do not save after a reboot, make sure you make them persistent.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .