I've been poking around with KVM VM's on Centos 6.4 not having an internet connection on my VM's, I found something curious:
Upon booting the machine, iptables has rules in the FORWARD chain to allow traffic through to the VM's and all is well. When I run
service iptables restart, however, it looks like it pulls the config rules from
/etc/sysconfig/iptables (default settings which reject all forwarding) and thus, I've been relegated to either dropping the firewall completely on the physical host or rebooting to get the FORWARD rules added so it works again.
Indeed, I could just modify the firewall rules myself to allow it, but isn't the focus of this question. I'm more focused on the following question #1:
My questions are:
- At what point (or by what mechanism) are these FORWARD rules added in?
- How can I recover the FORWARD rules without rebooting the machine?
Quite frankly, I'm not even sure where to start searching for this issue. I found this page that says to modify
/etc/sysctl.conf with the following variables which allegedly make netfilter ignore traffic to bridged connections:
net.bridge.bridge-nf-call-ip6tables = 0 net.bridge.bridge-nf-call-iptables = 0 net.bridge.bridge-nf-call-arptables = 0
The problem with that is that my
sysctl.conf is already set as such and netfilter still does its thing, happily blocking everything to the VM's.