- Users - libvirt List Archives

[libvirt-users] libvirt issue while deploying a VM
by Zvi Dubitzky 16 Jun '14

16 Jun '14

Using libvirt under openstack I encounter a problem when launching a VM with multiple partitions (2 G image) , While a single partition can be launched successfully . The launch is done with Openstack. We are using in libvirtd.conf log_level=1 and log_outputs="1:file:/var/log/libvirt/libvirtd.log" we can see that in /var/log/libvirt/libvirtd.log appear the following error message and the VM is finally shutdown : 2014-06-11 14:47:26.166+0000: 12971: error : qemuMonitorIO:614 : internal error End of file from monitor ( file attached below) ( VM shutdown seen here) The host has enough resources( we see no complains) and the XML of the VM is : The libvirt version is: 0.10.2 The qemu-kvm version: 0.12.1.2 >From the internet we could not figure out a solution to the problem Any idea what is causing this error and how to overcome ? Thx Zvi Dubitzky Email:dubi@il.ibm.com

2 3

[libvirt-users] libvirt, openSUSE, SuSeFirewall2 and port forwarding
by Johannes Kastl 14 Jun '14

14 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello list, I thought I had already asked this question, but apparently I just started writing a draft mail and never sent it (at least I can't find it in the archives). Has anyone setup qemu VMs using libvirt on openSUSE, and has gotten port forwarding to work? I used on of the many scripts out there, that go into /etc/libvirt/hooks/qemu, and it is being called. Somehow it seems once in a while SuSefirewall2 just forgets about iptable rules set with this script. And sometimes they don't appear, even if the script is executed. Anyone else having the same issues? Any openSUSE users willing to try this? Thanks in advance! Regards, Johannes - -- What do Bud Light and sex in a canoe have in common? Both is fuckin' close to water. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) Comment: Using GnuPG with SeaMonkey - http://www.enigmail.net/ iEYEARECAAYFAlOcmAAACgkQzi3gQ/xETbJRwwCfZe3YKXfQG7O0aHFDvD6EwXus a/8An36n1L/pAWSTuue3w0GG2ovAsw07 =aLj5 -----END PGP SIGNATURE-----

1 0

[libvirt-users] Status of Host machine.
by Sijo Jose 13 Jun '14

13 Jun '14

Hi, Using libvirt how can we check the status of a remote/local host machine.. isAlive() method is giving true even if the internet connection is broken OR libvirt demon in the remote machine is being stopped. so isAlive() does not seems to be handy, Is there some other way to get the status of remote host..? Thanks -Sijo

2 3

[libvirt-users] about sharing the hugepage memory segment between the host and the container
by WANG Cheng D 12 Jun '14

12 Jun '14

Dear all, What I want to do is to share a hugepage memory segment between the host and a container (I am trying to use intel DPDK package in container). For a normal memory (4k page), the memory sharing can be achieved by memory-mapped I/O (mmap())method with the same disk file on the host exposed to the container (that is, the host and the container share the same disk file). my questions are: 1) Do I need to mount the hugetlbfs in host and container respectively? 2) According to my understanding, the exposed file that will be shared by the host and container must locate at the hugetlbfs mount point. Is this right? 3) According to my understanding, the mount point in the host doesn't necessarily to be the same as that of the container, as long as the mount point is exposed to the container, Is this right? 4) If I want to share the hugepage memory segment betwen two containers, what's the answers for 1) ? 5) According to my internet research, if use open() to open a file under the hugepage mount point, the mmap() will automatically return a pointer to the hugepage memory segment. Is this right? Apart from this, I cannot see other difference from memory-mapped I/O with the 4k page memory. Any answer will be highly appreciated. Cheng Wang

1 0

[libvirt-users] Libvirt with virtualbox
by Dr. Boris Neubert 12 Jun '14

12 Jun '14

Hi, has anyone of you successfully used libvirt with VirtualBox? I ask because I haven't managed to connect to my machines and would like to benefit from your experience. Cheers Boris

2 1

[libvirt-users] Vulnerability in gnuTLS
by Boehme, Alfred 12 Jun '14

12 Jun '14

Hello, There is a vulnerability described in the gnuTLS library which is used in libvirt: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3466 We are using libvirt 0.8.7 on Windows so my question is: Is there already a windows version with a newer gnuTLS library which has a fix for the mentioned vulnerability? --- Sent from my Fujitsu Lifebook E782 With best regards Alfred Boehme Senior Developer PSO PM&D SV E SW 4 [cid:image001.gif@01CF8617.647717D0] FUJITSU Mies-van-der-Rohe-Str. 8, 80807 Munich, Germany Tel: +49 (89) 62060 2990 Mob: +49 (171) 62060 329 2990 E-mail: Alfred.Boehme(a)ts.fujitsu.com<mailto:Alfred.Boehme@ts.fujitsu.com> Web: ts.fujitsu.com<http://ts.fujitsu.com/> Company details: Fujitsu Technology Solutions GmbH / ts.fujitsu.com/imprint<http://ts.fujitsu.com/imprint.html> This communication contains information that is confidential, proprietary in nature and/or privileged. It is for the exclusive use of the intended recipient(s). If you are not the intended recipient(s) or the person responsible for delivering it to the intended recipient(s), please note that any form of dissemination, distribution or copying of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender and delete the original communication. Thank you for your cooperation. Please be advised that neither Fujitsu, its affiliates, its employees or agents accept liability for any errors, omissions or damages caused by delays of receipt or by any virus infection in this message or its attachments, or which may otherwise arise as a result of this e-mail transmission.

2 1

Re: [libvirt-users] a small problem about *Disk* type pool
by shyu 12 Jun '14

12 Jun '14

CC to libvirt-users mail list Thank you Eric ----- Original Message ----- | From: "Eric Blake" <eblake(a)redhat.com> | To: "shyu" <shyu(a)redhat.com> | Sent: Thursday, June 12, 2014 6:07:13 AM | Subject: Re: a small problem about *Disk* type pool | | On 06/10/2014 09:23 PM, shyu wrote: | > Hi Eric, | > | > There is a small problem about *Disk* type pool. | | This sort of question might be better on the libvirt-users mailing list, | as it will reach a wider audience. | | > | > On libvirt.org, the valid pool format type include "lvm2", which was | > introduce by commit c47884a. While "POOL_DISK_LVM2 can not be created by | > "parted mklabel" but is only returned from auto-detection on disk | > pools", should this word be added to the org in case of misleading | > building a "lvm2" type pool? | | Yes, it might make sense to document that libvirt can't currently create | lvm partitions automatically (but such support might be added in the | future, if parted is enhanced, or if libvirt is taught to use lvm tools | to do it). | | > | > And, since lvm2 can't be create by parted mklabel, while when build disk | > type pool, libvirt call "parted", so how POOL_DISK_LVM2 was created ? | | This particular enum value is used when reading a disk that was | partitioned externally by some other tool, and already had an lvm | partition on it (just because libvirt can't create it does not make it | any less useful for libvirt to report that it exists). | | -- | Eric Blake eblake redhat com +1-919-301-3266 | Libvirt virtualization library http://libvirt.org | | -- Regards shyu

1 0

[libvirt-users] support for distributed portgroups in esxi
by vivek hari 10 Jun '14

10 Jun '14

Hi, I tried to create a VM in ESXi 5.5 and to assign the interface to a Distributed switch portgroup. But i failed to achieve it. When i define a VM with distributed portgroup , i cannot see that distributed portgroup getting assigned to the VM network interface. My libvirt version is 0.10.2 I wish to know whether the libvirt supports assigning interface to a distributed port group ? If so how to proceed with it. Thanks, Vivek

1 0

[libvirt-users] TCP connection works for only remote host
by usha basavaraju 10 Jun '14

10 Jun '14

tcp connection working only for remote host . for localhost raising the following error >>> con=libvirt.open("qemu+tcp:///system") libvirt: XML-RPC error : unable to connect to server at 'localhost:16509': Connection refused Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/home/fluent/cvt/convirt-enterprise/tg2env/local/lib/python2.7/site-packages/libvirt.py", line 239, in open if ret is None:raise libvirtError('virConnectOpen() failed') libvirt.libvirtError: unable to connect to server at 'localhost:16509': Connection refused >>> Is there any other params to be set for local host connection..? please help

2 2

[libvirt-users] transient domain in virsh list as shut off
by Edoardo Comar 08 Jun '14

08 Jun '14

1 0

Re: [libvirt-users] Cannot obtain CPU freq during vbox machine creation
by Tomasz Kowal 07 Jun '14

07 Jun '14

Thanks for your help. My teacher advised me to use the "load_kld cpufreq" command and it resolved the problem. Tomasz Kowal

1 0

[libvirt-users] Cannot obtain CPU freq during vbox machine creation
by Tomasz Kowal 07 Jun '14

07 Jun '14

Dear libvirt experts, I can not instantiate even a simple machine when using the 'vbox' hypervisor: s14% virt-install --connect=vbox:///session --virt-type vbox --name vtest --memory 500 ERROR cannot obtain CPU freq: No such file or directory s14% virsh -c vbox:///session błąd: cannot obtain CPU freq: No such file or directory (1) How to fix this error? The VirtualBox driver seems to be installed: s14% virsh -V Narzędzie wiersza poleceń virsh biblioteki libvirt 1.2.5 Proszę zobaczyć stronę WWW pod adresem http://libvirt.org/ Compiled with support for: Hypervisors: QEMU/KVM UML VMWare PHYP VirtualBox ESX Test Networking: Remote Bridging Storage: Dir SCSI Miscellaneous: Daemon Secrets Debug Readline Modular s14% uname -a FreeBSD s14 9.3-PRERELEASE FreeBSD 9.3-PRERELEASE #0: Fri May 16 06:45:56 CEST 2 014 . Yours faithfully, Tomasz Kowal

4 3

[libvirt-users] Libvirt Python Bindings - Remote Connection using openAuth.
by Sijo Jose 06 Jun '14

06 Jun '14

Hi, I am using libvirt with python binding, and I want to connect to a remote host. I was able to connect after making ssh certificate, but It is not applicable for my project. So I want to use openAuth() method, but I could not succeed connecting to a remote host using it. Here is my code ------------------------ import libvirt USER = "root" PASS = "mypasswd" def authcb(credentials, user_data): for credential in credentials: if credential[0] == libvirt.VIR_CRED_AUTHNAME: credential[4] = USER elif credential[0] == libvirt.VIR_CRED_PASSPHRASE: credential[4] = PASS return 0 auth = [[libvirt.VIR_CRED_AUTHNAME, libvirt.VIR_CRED_PASSPHRASE], authcb, None] conn = libvirt.openAuth("qemu+ssh://192.168.1.21/system", auth, 0) print conn.getHostname() ------------------------------- *If there is something wrong, how am I supposed to use it.* If its not the right place to get libvirt-python related help, from where can I get it. Regards Sijo

2 3

[libvirt-users] Updating domain XML issue
by Brian Rak 05 Jun '14

05 Jun '14

I'm trying to unmount a guest cdrom using libvirt_domain_update_device (via php-libvirt). The guest cdrom is currently mounted via Ceph, via this XML: <disk type='network' device='cdrom'> <driver name='qemu' type='raw'/> <auth username='cdroms'> <secret type='ceph' uuid='XXXX'/> </auth> <source protocol='rbd' name='cdrom/test'/> <target dev='hdc' bus='ide'/> <readonly/> <address type='drive' controller='0' bus='1' target='0' unit='0'/> </disk> In order to unmount it, I'm trying to use this XML: <disk type='file' device='cdrom'> <driver name='qemu' type='raw'/> <target dev='hdc' bus='ide'/> <readonly/> <alias name='ide0-1-0'/> <address type='drive' controller='0' bus='1' target='0' unit='0'/> </disk> However, I'm getting an error from libvirt: 'internal error: invalid secret type 'ceph''. I suspect this is because it's still trying to use the authentication information from the old cdrom definition. How do I convince it to not do this? I've tried specifiying an empty <auth/> block, but that generates it's own error ('missing username for auth')

3 3

[libvirt-users] Problem connecting to hypervisor
by Vikas Kokare 03 Jun '14

03 Jun '14

I am trying to establish a connection (using virsh command) to a couple of hypervisor hosts, both on SLES 11.3 environments. The host from where i am making both the connections is a SLES 10.4 instance. *kvmh911351246:~ # virsh -c qemu+ssh://9.113.51.247:22/system <http://9.113.51.247:22/system>libvir: XML-RPC error : authentication requirederror: failed to connect to the hypervisor* The SSH authentication to hypervisor host 9.113.51.247 has already been established. *kvmh911351246:~ # ssh root(a)9.113.51.247 <root(a)9.113.51.247>Last login: Tue Jun 3 11:31:56 2014 from scm-kvmh2-rhel6 SLES11-51-247:~ #* Hence the cause of the authentication failure is not clear. The second connection to another SLES 11.3 host looks like *virsh # connect qemu+ssh://9.121.58.19:22/system <http://9.121.58.19:22/system> bash: socat: command not foundlibvir: Remote error : socket closed unexpectedlyerror: Failed to connect to the hypervisor* where the cause of the error is entirely different. The libvirt packages available on these environments are *9.113.51.247 (SLES 11.3)* *libvirt-cim-0.5.12-0.7.16libvirt-1.0.5.1-0.7.10libvirt-python-1.0.5.1-0.7.10libvirt-client-32bit-1.0.5.1-0.7.10 libvirt-lock-sanlock-1.0.5.1-0.7.10libvirt-client-1.0.5.1-0.7.10* *9.121.58.19 (SLES 11.3)* *libvirt-cim-0.5.12-0.7.16libvirt-client-1.0.5.1-0.7.10libvirt-python-1.0.5.1-0.7.10 libvirt-1.0.5.1-0.7.10* *9.113.51.246 ( SLES 10.4)* *libvirt-python-0.3.3-18.22.1libvirt-devel-0.3.3-18.22.1libvirt-0.3.3-18.22.1* How can these connection failures be debugged? Is there a way to know more information about them?

1 0

[libvirt-users] Live snapshots of a single block device
by Andrew Martin 03 Jun '14

03 Jun '14

Hello, I am working on a script to automatically create live snapshots of running VMs using qemu-kvm 1.4.0 and libvirt 1.0.2. If a VM has multiple disks, I'd like to back them up individually with separate calls to snapshot-create-as, so I can more easily manage the disk images. The code I have now is essentially as follows: virsh snapshot-create-as --domain "vmname" --name "snapshotname" --description "snapshot description" --disk-only --atomic --no-metadata --diskspec "vda" I run this command for each block device (e.g vda, vdb, etc). However, after running the above command (to only backup vda), I see that a snapshot has also been created for vdb. I tried running it with --print-xml, which gives this output: <domainsnapshot> <name>05-22-14_17-09-25</name> <description>05-22-14_17-09-25</description> <disks> <disk name='vda'/> </disks> </domainsnapshot> What am I doing wrong - how can I tell snapshot-create-as to create an external snapshot for a specific block device only (not all block devices)? Also, while looking at the manpage, does the --live option do anything different if used with the above command? Thanks, Andrew Martin

2 6

[libvirt-users] LIbvirt Python Snapshot -Domain Crashing
by Sijo Jose 03 Jun '14

03 Jun '14

Hi, I'm using libvirt(1.0.0) with python, for managing virtual machines.. but while taking multiple snapshot domain is crashing... Snapshot XML ------------------------- <domainsnapshot> <name>snp1</name> <creationTime></creationTime> <description>Description</description> <state></state> <domain> <uuid></uuid> </domain> <parent> <name></name> </parent> </domainsnapshot> ---------------- API Call -------------- snp1=domain1.snapshotCreateXML(snp_xml,0) here I'm passing flag value as zero.. Its created first snapshot without any error, but when I tried for second snapshot 1) Domain switched its state to pause and its not coming back I installed ubuntu12.04 OS in the domian. Rgds -Sijo

3 3

[libvirt-users] Wrong tty at autologin
by Mateusz Malicki 03 Jun '14

03 Jun '14

Hello, I am working on system that use systemd. On host user session (uid=5000) starts automatically but in container I have following error message: May 12 00:18:15 localhost user-session-launch[110]: pam_systemd(login:session): Asking logind to create session: uid=5000 pid=110 service=login type=tty class=user seat=seat0 vtnr=1 tty=tty1 display= remote=no remote_user= remote_host= May 12 00:18:16 localhost user-session-launch[110]: pam_systemd(login:session): Failed to create session: Invalid argument May 12 00:18:16 localhost user-session-launch[110]: pam_unix(login:session): session opened for user app by (uid=0) After hard coded tty=pts/0 and vtnr=0 session starts up. Is there any way to specify this values in xml config file or some other config files? Where did these values come from? Regards, Mateusz

1 0

[libvirt-users] Problem connecting to hypervisor
by Vikas Kokare 03 Jun '14

03 Jun '14

I am trying to establish a connection (using virsh command) to a couple of hypervisor hosts, both on SLES 11.3 environments. The host from where i am making both the connections is a SLES 10.4 instance. *kvmh911351246:~ # virsh -c qemu+ssh://9.113.51.247:22/system <http://9.113.51.247:22/system>libvir: XML-RPC error : authentication requirederror: failed to connect to the hypervisor* The SSH authentication to hypervisor host 9.113.51.247 has already been established. *kvmh911351246:~ # ssh root(a)9.113.51.247 <root(a)9.113.51.247>Last login: Tue Jun 3 11:31:56 2014 from scm-kvmh2-rhel6SLES11-51-247:~ #* Hence the cause of the authentication failure is not clear. The second connection to another SLES 11.3 host looks like *virsh # connect qemu+ssh://9.121.58.19:22/system <http://9.121.58.19:22/system>bash: socat: command not foundlibvir: Remote error : socket closed unexpectedlyerror: Failed to connect to the hypervisor* where the cause of the error is entirely different. The libvirt packages available on these environments are *9.113.51.247 (SLES 11.3)* *libvirt-cim-0.5.12-0.7.16libvirt-1.0.5.1-0.7.10libvirt-python-1.0.5.1-0.7.10libvirt-client-32bit-1.0.5.1-0.7.10libvirt-lock-sanlock-1.0.5.1-0.7.10libvirt-client-1.0.5.1-0.7.10* *9.121.58.19 (SLES 11.3)* *libvirt-cim-0.5.12-0.7.16libvirt-client-1.0.5.1-0.7.10libvirt-python-1.0.5.1-0.7.10libvirt-1.0.5.1-0.7.10* *9.113.51.246 ( SLES 10.4)* *libvirt-python-0.3.3-18.22.1libvirt-devel-0.3.3-18.22.1libvirt-0.3.3-18.22.1* How can these connection failures be debugged? Is there a way to know more information about them? -Vikas

1 0

[libvirt-users] kvm domain won't start with vhost-net loaded
by Raphael Bauduin 02 Jun '14

02 Jun '14

Hi, I have multiple kvm domains running fine, but to improve network performance, I wanted to try vhost-net. However, once I load the module: modprobe vhost-net I can't start the domain anymore: virsh start kvmGitInt gives the error: internal error: process exited while connecting to monitor: qemu-system-x86_64: -netdev tap,fd=25,id=hostnet0,vhost=on,vhostfd=26: vhost-net requested but could not be initialized qemu-system-x86_64: -netdev tap,fd=25,id=hostnet0,vhost=on,vhostfd=26: Device 'tap' could not be initialized This is a 3.14.4 kernel, with libvirt 1.2.1 and qemu 1.7.0. I have searched online but haven't found any indication on how to solve it in my case (The kernel is not selinux enabled,not using systemd, ...) Any suggestion on how to solve this is very welcome! Thanks in advance Raph

1 0

[libvirt-users] Libvrt Migrate an Offline VM
by Sijo Jose 30 May '14

30 May '14

Hi, Is it possible to migrate an Offline VM using libvirt API ? Regards Sijo Jose

3 2

[libvirt-users] Host OS, Storage Info
by Sijo Jose 30 May '14

30 May '14

Hi, Is there any way to get host OS information and host Storage in formations using libvirt API...? Rgds -Sijo

3 6

[libvirt-users] More than one certificate authority
by Емил Гелев 30 May '14

30 May '14

Hello. I have a question about libvirt remote access. I read carefully how to set up TLS authorization guide and I have done all the steps. Everything works, but for my virtualization infrastructure I need more flexibility. How can I configure a single host to trust more than one certificate authority. Lets say, for example, that I have 10 virtualization hosts and each of them has certificates signed by the same CA (lets say CA1) and they trust each other. But I have a client which does not have a client certificate signed by CA1, but has a certificate signed by CA2. I do not want my virtualization hosts to trust the CA2 except for just one of them. I want to provide this client with authorized access to one of my hosts. So this specific host must trust CA1 and CA2 as well, but in the '/etc/libvirt/libvirtd.conf' file I can point the certificate of only one CA. How can I set up such a configuration ? The same question is valid for the client. How can I configure a client to trust CA1 and CA2 ?

1 0

[libvirt-users] Hot memory and cpu update
by usha.basavaraju＠fluentsoft.com 30 May '14

30 May '14

Runing domain xml vv.XMLDesc(0) n ub_test1n 714dde02-76c9-7d45-25af-e50f0a54f4bcn 545792n 545792n 4n n hvmn n n n n n n destroyn restartn destroyn n /usr/bin/kvmn n n n n n n n n n n n n n n n n n n n n n n n n n n n n nn" >>> vv.info() [1, 545792L, 545792L, 1, 6320000000L] 1. >>> vv.setMemoryFlags(545794) libvir: QEMU Driver error : invalid argument: cannot set memory higher than max memory Traceback (most recent call last): File "", line 1, in File "/home/fluent/cvt/convirt-enterprise/tg2env/local/lib/python2.7/site-packages/libvirt.py", line 1781, in setMemoryFlags if ret == -1: raise libvirtError ('virDomainSetMemoryFlags() failed', dom=self) libvirt.libvirtError: invalid argument: cannot set memory higher than max memory >>> vv.setMemoryFlags(545790) 0 >>> vv.info() [1, 545792L, 545792L, 1, 6480000000L] >>> vv.setMemoryFlags(545788) 0 >>> vv.info() [1, 545792L, 545792L, 1, 6480000000L] If increase memory giving the above. if decreased memory it is running the command successfully but not changing the value 2.Vcpu update >>> vv.setVcpusFlags(2) libvir: QEMU Driver error : internal error got wrong number of vCPU pids from QEMU monitor. got 4, wanted 2 Traceback (most recent call last): File "", line 1, in File "/home/fluent/cvt/convirt-enterprise/tg2env/local/lib/python2.7/site-packages/libvirt.py", line 1884, in setVcpusFlags if ret == -1: raise libvirtError ('virDomainSetVcpusFlags() failed', dom=self) libvirt.libvirtError: internal error got wrong number of vCPU pids from QEMU monitor. got 4, wanted 2 >>> vv.setVcpusFlags(5) libvir: QEMU Driver error : invalid argument: requested vcpus is greater than max allowable vcpus for the domain: 5 > 4 Traceback (most recent call last): File "", line 1, in File "/home/fluent/cvt/convirt-enterprise/tg2env/local/lib/python2.7/site-packages/libvirt.py", line 1884, in setVcpusFlags if ret == -1: raise libvirtError ('virDomainSetVcpusFlags() failed', dom=self) libvirt.libvirtError: invalid argument: requested vcpus is greater than max allowable vcpus for the domain: 5 > 4 Cant increase or decrease vcpu. ------------------------- Message sent via Atmail Open - http://atmail.org/

1 0

[libvirt-users] nwfilter usage
by Matt LaPlante 28 May '14

28 May '14

I'm trying to accomplish what I had hoped would be a fairly simple filtering of traffic to my VMs, but I'm hitting a snag. The VMs are allowing traffic when I wouldn't expect them to. Host and Guest are both running the same platform: Ubuntu 12.04.4 LTS 0.9.8-2ubuntu17.19 I have a basic bridge enabled on the host: brctl addbr brdg brctl addif brdg eth1 ip link set brdg up The host has iptables support: root@host:~# lsmod | grep filt ip6table_filter 12815 0 ip6_tables 27864 2 ip6table_filter,xt_TPROXY iptable_filter 12810 1 ip_tables 27473 4 iptable_raw,iptable_nat,iptable_mangle,iptable_filter x_tables 29891 52 ebt_arp,ebt_ip,ip6table_filter,ebtables,xt_time,xt_connlimit,xt_realm,xt_addrtype,iptable_raw,xt_comment,xt_recent,xt_policy,ipt_ULOG,ipt_REJECT,ipt_REDIRECT,ipt_NETMAP,ipt_MASQUERADE,ipt_ECN,ipt_ecn,ipt_CLUSTERIP,ipt_ah,xt_set,xt_TPROXY,ip6_tables,xt_tcpmss,xt_pkttype,xt_physdev,xt_owner,xt_NFQUEUE,xt_NFLOG,xt_multiport,xt_mark,xt_mac,xt_limit,xt_length,xt_iprange,xt_helper,xt_hashlimit,xt_DSCP,xt_dscp,xt_dccp,xt_conntrack,xt_connmark,xt_CLASSIFY,xt_AUDIT,ipt_LOG,xt_tcpudp,xt_state,iptable_nat,iptable_mangle,iptable_filter,ip_tables Guest network using bridge: <interface type='bridge'> <mac address='00:11:22:33:44:55'/> <source bridge='brdg'/> <model type='virtio'/> <filterref filter='outbound-only'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> </interface> <filter name='outbound-only' chain='root'> <uuid>0c834381-402c-faf3-019f-eb5a40ea6b61</uuid> <filterref filter='allow-arp'/> <filterref filter='allow-dhcp'/> <filterref filter='qemu-announce-self'/> <filterref filter='no-other-l2-traffic'/> </filter> My goal is to allow the guest to reach the internet, but not allow the internet or other guests to reach this guest. I realize this config is not sufficient for that, but I can't get any farther until I understand the current behavior. From the look of the config, this should essentially not be allowing anything except arp and dhcp. And yet, the host has full connectivity. I can run apt-get update on the VM, I can ping the VM from other nodes in my network, etc. It's basically wide-open. So either one of the included rules is not working as advertised, or I'm misunderstanding some feature of the filtering process. Any pointers would be appreciated. Thanks

4 5