Re: [libvirt-users] Default firewall rules and forwarding to a guest

On 12/22/2016 09:48 AM, Omer Aldemir wrote: libvirt will add its iptables rules via firewalld if firewalld is enabled and running, otherwise it executes iptables commands directly. w There are no configuration files for the iptables rules that libvirt adds. The simple set of rules that is added is fixed for each type of libvirt network - NAT, routed, and isolated. Here is a description of exactly what is added for each of these types of network: https://libvirt.org/firewall.html (actually I just realized that I forgot to add information there about a new network forwarding type I recently added - "open", which doesn't add *any* iptables rules - this is intended for those who want to do their own iptables setup for libvirt networks, outside of libvirt.) To reload all the iptables rules for all active libvirt networks, just restart the libvirtd service. The best that can be done with current libvirt is to create a "hook" script similar to the one described here: https://wiki.libvirt.org/page/Networking#Forwarding_Incoming_Connections (That worked the last time I tried it, but that was at least 3 years ago. The python script available as a link from that page is newer and promises to be easier to understand (maybe))