On Sun, Mar 07, 2010 at 07:39:59PM +0530, Varrun Ramani wrote:
Hi
I am right now undertaking a project which deals with verification of
firewall rules. I wish to know which applications/libraries modify/query
firewall rules. I came to know that libvirt modifies iptables rules. Can
anyone let me know for what purposes/how libvirt modifies the rules?
The 'virtual network' functionality in libvirt sets up a isolated bridge
device, to which guests are connected. libvirt uses iptables to control
what happens to traffic on that bridge device. Either we stop it leaving
the bridge entirely (only VM<->VM and VM<->host), or allow it to get to
the LAN either routing a subnet, or using NAT to masquerade it. The
rules are written such that they only match traffic relating to the
configured bridge device in libvirt, so they shouldn't expose the rest of
the host interfaces to any new traffic risks
Regards,
Daniel
--
|: Red Hat, Engineering, London -o-
http://people.redhat.com/berrange/ :|
|:
http://libvirt.org -o-
http://virt-manager.org -o-
http://deltacloud.org :|
|:
http://autobuild.org -o-
http://search.cpan.org/~danberr/ :|
|: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|