- Users - libvirt List Archives

iptables rule affects vnet0?
by daggs 09 Apr '25

09 Apr '25

Greetings, I have a 2 vms on a host that can communicate with other hosts on the system. the two vms are connected by a virtsw0 bridge (vm1 and vm2) and on of the vms (vm1) has another connection (vnet0) to the host. it seems that the host can only communicate with the vm that has a direct connection to it and not the other vm (virtsw0 allows connection beteen both vms) here are the rules libvirt creates: -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -N LIBVIRT_FWI -N LIBVIRT_FWO -N LIBVIRT_FWX -N LIBVIRT_INP -N LIBVIRT_OUT -A INPUT -j LIBVIRT_INP -A FORWARD -j LIBVIRT_FWX -A FORWARD -j LIBVIRT_FWI -A FORWARD -j LIBVIRT_FWO -A OUTPUT -j LIBVIRT_OUT -A LIBVIRT_FWI -o virsw0 -j REJECT --reject-with icmp-port-unreachable -A LIBVIRT_FWO -i virsw0 -j REJECT --reject-with icmp-port-unreachable -A LIBVIRT_FWX -i virsw0 -o virsw0 -j ACCEPT -A LIBVIRT_INP -i virsw0 -p udp -m udp --dport 53 -j ACCEPT -A LIBVIRT_INP -i virsw0 -p tcp -m tcp --dport 53 -j ACCEPT -A LIBVIRT_INP -i virsw0 -p udp -m udp --dport 67 -j ACCEPT -A LIBVIRT_INP -i virsw0 -p tcp -m tcp --dport 67 -j ACCEPT -A LIBVIRT_OUT -o virsw0 -p udp -m udp --dport 53 -j ACCEPT -A LIBVIRT_OUT -o virsw0 -p tcp -m tcp --dport 53 -j ACCEPT -A LIBVIRT_OUT -o virsw0 -p udp -m udp --dport 68 -j ACCEPT -A LIBVIRT_OUT -o virsw0 -p tcp -m tcp --dport 68 -j ACCEPT and here are the stats: Chain INPUT (policy ACCEPT 17405 packets, 1677K bytes) pkts bytes target prot opt in out source destination 17434 1688K LIBVIRT_INP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 LIBVIRT_FWX all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 LIBVIRT_FWI all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 LIBVIRT_FWO all -- * * 0.0.0.0/0 0.0.0.0/0 Chain OUTPUT (policy ACCEPT 21058 packets, 3788K bytes) pkts bytes target prot opt in out source destination 21058 3788K LIBVIRT_OUT all -- * * 0.0.0.0/0 0.0.0.0/0 Chain LIBVIRT_FWI (1 references) pkts bytes target prot opt in out source destination 0 0 REJECT all -- * virsw0 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable Chain LIBVIRT_FWO (1 references) pkts bytes target prot opt in out source destination 0 0 REJECT all -- virsw0 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable Chain LIBVIRT_FWX (1 references) pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- virsw0 virsw0 0.0.0.0/0 0.0.0.0/0 Chain LIBVIRT_INP (1 references) pkts bytes target prot opt in out source destination 0 0 ACCEPT udp -- virsw0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 0 0 ACCEPT tcp -- virsw0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 29 10608 ACCEPT udp -- virsw0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:67 0 0 ACCEPT tcp -- virsw0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:67 Chain LIBVIRT_OUT (1 references) pkts bytes target prot opt in out source destination 0 0 ACCEPT udp -- * virsw0 0.0.0.0/0 0.0.0.0/0 udp dpt:53 0 0 ACCEPT tcp -- * virsw0 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 0 0 ACCEPT udp -- * virsw0 0.0.0.0/0 0.0.0.0/0 udp dpt:68 0 0 ACCEPT tcp -- * virsw0 0.0.0.0/0 0.0.0.0/0 tcp dpt:68 is it possible I cannot access vm2 from the host because of the rules above? Thanks, Dagg

1 0

How to use microVM as a machine type?
by Qu Wenruo 08 Apr '25

08 Apr '25

Hi, Recently I'm hitting a bug related to edk2 that sometimes boot up can be very slow (before loading the bootloader): https://github.com/tianocore/edk2/issues/10765 It looks like the cause is the related to flash IOs. So I want to try using microVM machine type, as it's json file describes the device mapping is "memory", which should work around the slow boot. But I'm unable to setup a machine using microVM machine type in virtual-manager. And manually editing the xml file doesn't let me go any further, as VMM creates a default xml with ACPI feature, which is not supported by microVM. So I'm wondering, what's the proper way to use microVM machine type inside libvirt? Thanks, Qu

2 1

libvirt KVM virtual NIC as ens160 for running a virtual appliance designed for Vmware
by Sascha Frey 31 Mar '25

31 Mar '25

Hi, I want to run a virtual appliance which was designed for Vmware on libvirt Linux/KVM. Unfortunately, they hardcoded the kernel NIC name to ens160 inside that image. I can create a libvirt XML which creates a NIC recognised as ensXX, but not ens160, because libvirt doesn’t allow PCI slots over 0x1f. Is there any possible way to create a virtual NIC ens160 without modifying the image? Thanks.

2 1

Re: Capture pcap for each VM
by Laine Stump 31 Mar '25

31 Mar '25

(added users(a)lists.libvirt.org back into the Cc so that anyone else asking the same question in the future will benefit from the answer) On 3/28/25 8:12 AM, James Liu wrote: > Hi Laine, > > I tried your first solution but somehow it didn't work(the network is > NAT). I edited the xml in virt-manager gui. Whenever I added following > options, and click "Apply", the virt-manager will revert(remove) the > "alias" tag; consequently, the qemu command line couldn't find the > device name('foo' in this example). Sorry, I had meant to point this out but somehow forgot - user-specified aliases must begin with "ua-", otherwise they will be ignored. So instead of using "<alias name='foo'/>", use "<alias name='ua-foo'/>" (and then in the <qemu:arg value> use "netdev=hostua-foo") Also note that your guest should be shutdown while you're making these changes. > > Appreciate your suggestions. > > <interface type="network"> > <mac address="52:54:00:3a:bf:52"/> > <source network="default"/> > <model type="e1000e"/> > <alias name="*foo*"/> # virt-manager will always remove > this tag > <address type="pci" domain="0x0000" bus="0x01" slot="0x00" > function="0x0"/> > </interface> > > <qemu:commandline> > <qemu:arg value="-object"/> > <qemu:arg value="filter-dump,id=f1,netdev=*foo*,file=/tmp/xyzzy.pcap"/> > </qemu:commandline>

1 0

Clarifying isolated network rules in nftables
by Alexey Kashavkin 27 Mar '25

27 Mar '25

Hi, I’m trying to understand how firewall filter works for isolated network in libvirt v11.1.0. When I start the network I can see following rules in nftables: table ip libvirt_network { chain forward { type filter hook forward priority filter; policy accept; counter packets 0 bytes 0 jump guest_cross counter packets 0 bytes 0 jump guest_input counter packets 0 bytes 0 jump guest_output } chain guest_output { iif "virbr3" counter packets 0 bytes 0 reject } chain guest_input { oif "virbr3" counter packets 0 bytes 0 reject } chain guest_cross { iif "virbr3" oif "virbr3" counter packets 0 bytes 0 accept } chain guest_nat { type nat hook postrouting priority srcnat; policy accept; } } But when I start ping from one VM to another on the same isolated network, I don't see an increase in counters in either chain. In the libvirt code, I found a comment in src/network/network_nftables.c: /** * nftablesAddForwardAllowCross: * * Add a rule to @fw to allow traffic to go across @iface (the virtual * network's bridge) from one port to another. This allows all traffic * between guests on the same virtual network. */ But it seems that these rules don't work and are not needed. If I delete this table or some chains, nothing happens. VMs have connectivity with each other on this network. What are these rules for?

2 1

Capture pcap for each VM
by icefrog1950＠gmail.com 26 Mar '25

26 Mar '25

Hi, Is possible to capture pcaps for each VM individually? QEMU supports command line '-object filter-dump, file=test.pcap'. I'm not sure if Libvirt supports this features, or there are better ways to solve this. Many thanks.

2 1

Running DHCP server inside of the Guest VM instead of the host.
by gameplayer2019pl＠tutamail.com 26 Mar '25

26 Mar '25

Hello, I've recently tried to run KEA DHCP server inside of a Debian VM and the following host interface configuration, attached to that VM: ``` <network> <name>netasn-dhcpv6</name> <bridge name="netasn-dhcpv6" stp="on" delay="0"/> <mtu size="1500"/> <mac address="XX:XX:XX:XX:XX:XX"/> <dns enable="no"/> <ip family="ipv6" address="2a14:7581:feb::1" prefix="64"> </ip> </network> ``` But whenever I'm trying to run dhclient on another Debian VM attached to the same network I couldn't obtain the IPv6 lease from KEA DHCP. The host is as well running Debian, 12 version. Is there anyway to make the DHCP work from Guest VM instead of using built-in libvirt DHCP?

2 2

Integrating Open Virtual Network with Libvert Provisioned VMs
by odukoyaonline＠gmail.com 26 Mar '25

26 Mar '25

I am having a little confusion trying to integrate OVN defined networks(I tried with Ovs and it worked fine) with the VMs I have provisioned with Libvirt. I want to ask if there are resource around this and if not, will appreciate input from anyone who has a prior experience with it no matter how little.

1 0

General use of zstd instead of zlib compression
by Michael Niehren 17 Mar '25

17 Mar '25

Hi, currently i use on all VM's qcow2-Images with zlib compression. If i do an Backup, the Backup-Image will be compressed with zstd Level 3 to shrink the image for transfering it over not so fast internet connections. So, why not directly using zstd compression on the images. Are there any reason's not to do that ? As i always use virt-manager for administration, i patched qemu (V9.2.2) to create on default zstd compressed images (only 1 change in line 3525). So newly created images do have compression type zstd, which work's (qemi-img info). I see one unusual thing. If i do an qemi-img convert with compression_type=zstd the size of the converted image is much smaller than the original file while "qemu-img info" shows on both as compression type zstd. Do they use different compression levels, maybe ? If i now do an virsh backup-begin <domain>, the backup-Image does also has a bigger size than the original, while showing zstd as compression type (qemu-img info). If i convert it with the similar command as above, both converted images has nearly the same size. Even if i copy the smaller converted image to the original and boot the vm from the smaller image, the backup-image (after backup-begin) is bigger. So, i am confused. Are there any explanations about the different image sizes or what's going on here ? best regards Michael

3 10

live migration of SR-IOV vm
by Paul B. Henson 17 Mar '25

17 Mar '25

I have a vm using an sr-iov NIC that I'm testing live migration on (Debian 12, OS packages). Per the documentation, I have the sr-iov link set as transient with a pointer to the persistent virtio link: <interface type='network'> <mac address='52:54:00:a1:e0:38'/> <source network='sr-iov-intel-10G-1'/> <vlan> <tag id='400'/> </vlan> <model type='virtio'/> <teaming type='transient' persistent='ua-sr-iov-backup'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </interface> and a persistent virto link down by default: <interface type='direct'> <mac address='52:54:00:a1:e0:38'/> <source dev='eno5np0.400' mode='bridge'/> <model type='virtio'/> <teaming type='persistent'/> <link state='down'/> <alias name='ua-sr-iov-backup'/> <address type='pci' domain='0x0000' bus='0x07' slot='0x00' function='0x0'/> </interface> The failover driver finds this in the vm: 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 100 0 3: eth1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel master eth0 state DOWN mode DEFAULT group default qlen 1000 10: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master eth0 state UP mode DEFAULT group default qlen 1000 and the network works fine. However, during migration, the sr-iov interface is removed, but the link on the virtio interface is *not* brought up: 2: eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default qlen 1000 3: eth1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel master eth0 state DOWN mode DEFAULT group default qlen 1000 resulting in no network for part of the migration. Once the box finished migrating, the replacement sv-iov link is plugged back in, and all is well once again: 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000 3: eth1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel master eth0 state DOWN mode DEFAULT group default qlen 1000 11: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master eth0 state UP mode DEFAULT group default qlen 1000 My understanding was that virsh migrate was supposed to automatically bring up the virtio link when the sr-iov link is removed? Or do I need to explicitly bring it up myself before the migration and take it down after? If I bring up the link manually before the migration, there are a few packets lost at that time, but then none are lost during the migration when the sr-iov link is pulled, or after the migration when I shut that link down again. Ideally no packets would be lost :), but I realize that's unlikely in practice... Thanks...

1 1