Re: [libvirt-users] nwfilter and address of network ip address

On Fri, May 5, 2017 at 4:29 PM, Nicolas Bock <nicolasbock(a)gmail.com&gt; wrote: I used to have similar question before too. Not sure if this could be helpful for you, Probably just use arp or arpscan. But to be more specific, if the domain name of the client (assuming you want to confine HTTP service to only a selected few clients, e.g., 192.168.122.1 in your case) is known, you probably could do $ virsh domiflist DOMAIN In particular, to get the IP address of a domain, it is something like the following: $ for MAC in `virsh domiflist <DOMAIN> | grep -o -E "([0-9a-f]{2}:){5}([0-9a-f]{2})"` ; do arp -e | grep $MAC | grep -o -P "^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}" ; done Alternatively, if the NETWORK name is known, IP addr can be obtained directly with $ virsh net-dhcp-leases NETWORK Another way to the get IP addr, if qemu guest agent is installed on the client, $ virsh domifaddr DOMAIN So that you can pass IP to the XML, and somehow you can trigger the update of NWFILTER with some magic, quite a hack. Or, you could just use client's MAC addr to define the filter: https://libvirt.org/formatnwfilter.html#nwfelemsRulesProtoMAC But I don't think there is direct way to specify a client's domain name in the NWFILTER XML definition as of now. P.S. I am new to libvirt, so everything above could be wrong. Dan _______________________________________________