After 7431b3eb9a05068e4b libvirt requires "filter", "nat" and "mangle" tables to exist for both IPv4 and IPv6. This fact was missed in the news.xml and since we don't have any better place to advertise that let's update old news. This was refined in 686803a1a2e and since that is not released yet create a new entry documenting the refinement. Signed-off-by: Michal Privoznik <mprivozn@redhat.com> --- Even though the v1 was ACKed, I'm sending v2 because things have changed since then. The difference to v1 then is that I've introduced a new news entry for the current release mentioning the refinement. IMO this reflects the reality the best: 5.1.0, which is released and doesn't contain the fix does require all 6 tables (even though Dan created v5.1.0-maint branch where he backported the fix). docs/news.xml | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/docs/news.xml b/docs/news.xml index 5c3028e10b..83e965e0f3 100644 --- a/docs/news.xml +++ b/docs/news.xml @@ -124,6 +124,18 @@ Report class information for PCI node device capability. </summary> </change> + <change> + <summary> + Split setup of IPv4 and IPv6 top level chain + </summary> + <description> + The requirement resulting from private chains improvement done + in <code>v5.1.0</code> was refined so that only tables from + corresponding IP version are required. This means that if a + network doesn't have <code>IPv6</code> enabled then those + tables are not required. + </description> + </change> </section> <section title="Bug fixes"> </section> @@ -202,7 +214,9 @@ Historically firewall rules for virtual networks were added straight into the base chains. This works but has a number of bugs and design limitations. To address them, libvirt now puts - firewall rules into its own chains. + firewall rules into its own chains. Note that with this change the + <code>filter</code>, <code>nat</code> and <code>mangle</code> tables + are required for both <code>IPv4</code> and <code>IPv6</code>. </description> </change> <change> -- 2.19.2