I have a VM using the default QEMU/KVM virtual network NAT adapter. Host is running Ubuntu Desktop 20.04. Guest is running Windows 10. I have setup a simple libvirt filter to block access to my Local Area Network so the guest cannot see it:

cat > no-localnet <<EOF
<filter name='no-localnet' chain='ipv4' priority='-700'>
<rule action='drop' direction='out' priority='500'>
<all dstipaddr='' dstipmask='16' comment='reject localnet out'/>
<rule action='drop' direction='in' priority='500'>
<all srcipaddr='' srcipmask='16' comment='reject localnet in'/>
virsh nwfilter-define no-localnet

Also added to the VM NIC xml settings:

<interface type="network">
  <filterref filter="no-localnet"/>

The filter worked the first time I added it, but after rebooting the Host, it never worked again, no matter what I change.

  • Please clarify what happens instead.
    – Alex
    Nov 5, 2020 at 20:17
  • @Alex How it should work is to drop any network packets sent or received on the LAN (, but it is not working at all, I can ping and access the network devices freely, but the first time when I applied the filter, it worked, the VM could not ping or access any devices on my Local Area Network, then after a host reboot, it never worked again
    – Fred
    Nov 6, 2020 at 10:09
  • I would like to add that I have reinstalled libvirt + kvm/qemu with the same result, no success.
    – Fred
    Nov 6, 2020 at 15:36

1 Answer 1


Found a workaround using IPTables

sudo iptables -I INPUT -d -s -j DROP
sudo iptables -I INPUT -s -d -j DROP
sudo iptables -I OUTPUT -d -s -j DROP
sudo iptables -I OUTPUT -s -d -j DROP
sudo iptables -I FORWARD -d -s -j DROP
sudo iptables -I FORWARD -s -d -j DROP

where would be the range of IP's you want to block from accessing the local area network, in this case, the ones assigned to the VM. Note: these do not save after a reboot, make sure you make them persistent.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .