[libvirt-users] Problems when filtering on icmpv6
Hi,
I am trying to prevent my qemu guest machines from sending IPv6 router
advertisements over their network device. To that end, I have written this
filter definition:
<filter name='no-ipv6-router-advertisement' chain='root'
priority='-690'>
<rule action='drop' direction='out' priority='600'>
<icmpv6 type='134'/>
</rule>
<rule action='drop' direction='out' priority='600'>
<icmpv6 type='153'/>
</rule>
</filter>
As soon as I try to use this filter, though, I get the following error (in
virsh):
error: Error while building firewall: Some rules could not be created for
interface vnet0: Failure to execute command '$IPT -A libvirt-out -m physdev --
physdev-out vnet0 -g FP-vnet0' : 'ip6tables: No chain/target/match by that
name.'.
I am (trying to) use this filter by including it in here:
<filter name='clean-traffic-with-v6' chain='root'>
<filterref filter='no-mac-spoofing'/>
<filterref filter='no-ip-spoofing'/>
<filterref filter='no-dhcp-server'/>
<rule action='accept' direction='out' priority='-650'>
<mac protocolid='ipv4'/>
</rule>
<filterref filter='allow-incoming-ipv4'/>
<filterref filter='no-ipv6-spoofing'/>
<filterref filter='no-ipv6-router-advertisement'/>
<filterref filter='no-dhcpv6-server'/>
<rule action='accept' direction='out' priority='-600'>
<mac protocolid='ipv6'/>
</rule>
<filterref filter='allow-incoming-ipv6'/>
<filterref filter='no-arp-spoofing'/>
<rule action='accept' direction='inout' priority='-500'>
<mac protocolid='arp'/>
</rule>
<filterref filter='no-other-l2-traffic'/>
<filterref filter='qemu-announce-self'/>
</filter>
Without the line
<filterref filter='no-ipv6-router-advertisement'/>
this filter works fine.
When running a domain with this filter without the no-ipv6-router-
advertisement filterref, my ip6tables look like this:
# ip6tables-save
# Generated by ip6tables-save v1.4.13 on Wed Nov 7 17:46:32 2012
*mangle
:PREROUTING ACCEPT [146:12680]
:INPUT ACCEPT [103:9704]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [172:14184]
:POSTROUTING ACCEPT [172:14184]
COMMIT
# Completed on Wed Nov 7 17:46:32 2012
# Generated by ip6tables-save v1.4.13 on Wed Nov 7 17:46:32 2012
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:libvirt-host-in - [0:0]
:libvirt-in - [0:0]
:libvirt-in-post - [0:0]
:libvirt-out - [0:0]
-A INPUT -j libvirt-host-in
-A FORWARD -j libvirt-in
-A FORWARD -j libvirt-out
-A FORWARD -j libvirt-in-post
COMMIT
# Completed on Wed Nov 7 17:46:32 2012
This is with libvirt 0.10.2.
Does anybody have an idea what is happening here or how I could debug this
further?
Regards,
Guido