[libvirt] iptables --physdev-out warnings

Hi, we've experienced some issues with starting lots of KVM based VM's with libvirt. Since I couldn't find any clues on the libvirt mailing list, I'm posting the way I fixed the issues. When starting a VM, /var/log/messages was spammed with the following message: xt_physdev: using --physdev-out in the OUTPUT, FORWARD and POSTROUTING chains for non-bridged traffic is not supported anymore. With each extra VM I start, the messages get amplified exponentially. This results in longer starting times every new VM, relative the the previously started VM. When I ran a test with starting 100 equal VM's, the first VM started in about 2 seconds, the 100th VM took 48 seconds to start. I'm running a vanilla 3.7.1 kernel, but I have the same issue on VM hosts with kernel 3.2.28 or 3.2.0, running libvirt 0.9.12 and 0.9.8 respectively. Looking into the warning, it seemed that iptables need an extra argument, --physdev-is-bridged, in commands like: iptables -A libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet99 -g FP-vnet99 I patched the libvirt source (version 1.0.0) to test whether this works or not: --- src/nwfilter/nwfilter_ebiptables_driver.c.orig 2013-01-16 10:51:43.000000000 +0100 +++ src/nwfilter/nwfilter_ebiptables_driver.c 2013-01-16 10:52:07.000000000 +0100 @@ -166,7 +166,7 @@ snprintf(buf, sizeof(buf), "%c%c-%s", prefix[0], prefix[1], ifname) #define PHYSDEV_IN "--physdev-in" -#define PHYSDEV_OUT "--physdev-out" +#define PHYSDEV_OUT "--physdev-is-bridged --physdev-out" static const char *m_state_out_str = "-m state --state NEW,ESTABLISHED"; static const char *m_state_in_str = "-m state --state ESTABLISHED"; The warnings in /var/log/messages are gone and running the test again proved the 100th VM started in 3.8 seconds. It suprises me I'm the first to mention this problem on the libvirt mailing list and I wondering if I'm doing something wrong. Until then, this fix helps me a lot! Reinier Schoof -- TransIP BV | https://www.transip.nl/