Hi All,
I am new to libvirt and encounter a strange problem to set up network
filter in a NAT network.
I launched VMs in a single host using NAT, i.e. interface
type='network'. Now I want to control the outbound traffic from VM
instance - only allow the VM to asses a set of ip addresses. My
network filter xml is as follows. The problem is once I change the VM
xml, shutdown and start VM, VM cannot get ip address.
/var/log/libvirt/libvirt.log shows " error : virNetDevGetIndex:656 :
Unable to get index for interface vnet2: No such device" error.
But when I remove the drop rule in the filter xml, VM can get IP
address. I even tried the clean-traffic filter shipped with libvirt.
VM throws the same error above.
Any idea why this happens? How can I implement outbound traffic
control in libvirt? Thanks a lot.
<filter name='filter-test'>
<rule action='accept' direction='in' priority='500'>
<tcp dstportstart='22'/>
</rule>
<rule action='accept' direction='out' priority='500'>
<ip dstipaddr='IP1'/>
</rule>
<rule action='accept' direction='out' priority='500'>
<ip dstipaddr='IP2'/>
</rule>
<rule action='drop' direction='out' priority='500'>
<all/>
</rule>
</filter>
The VM network section XML looks like this
<interface type='network'>
<mac address='52:54:00:0d:f1:ce'/>
<source network='default'/>
<filterref filter='filter-test'/>
<address type='pci' domain='0x0000' bus='0x00'
slot='0x03'
function='0x0'/>
</interface>
--
Regards,
Jiaan
Show replies by date