Re: [libvirt] How to prevent libvirt from adding iptables rules?

On Thu, Apr 02, 2009 at 10:16:13AM +0200, Ludwig Nussel wrote: > Daniel P. Berrange wrote: > > On Tue, Mar 31, 2009 at 04:08:24PM -0300, Mariano Absatz wrote: > > > [...] > > > I modified my VMs to use isolated rather than default, but rules keep > > > being added to iptables when libvirt-bin is started. > > > > > > Is there a way to convince libvirt not to add these rules? > > > > No, libvirt needs to add the rules here because otherwise the guest > > virtual network would not be guarenteed to be isolated from the host > > network. > > Messing with iptables rules isn't guaranteed to work either. Esp if the > existing firewall is re-run. SuSEfirewall2 for example runs when > interfaces come or go so it will kill any rules that someone added > behind it's back. We have a similar issue with the Fedora equivalent of SuSSfirewall, and it provides a mechanism for us to register the set of rules we want, so when it is re-run, it re-adds our rules.