Re: [libvirt-users] guest A from virbr0 can talk to guest B in virbr1 but not vice versa

On 06/20/2017 05:27 AM, Martin Kletzander wrote: That is correct. That doesn't achieve the desired results (as you figured out later, according to your followup comments. Yep! That's actually a known bug that has been there "forever". It has always been brought up in the context of "I want communication between my NATed networks, and it only works in one direction!", rather than "I want to block communication between my NATed networks, but it gets past in one direction!". When people learn that it's (kind of) blocked, they work around it by adding a new network that is shared by all the guests. Because all of the reports have been in this direction, fixing it properly has been very low on (my) priority list. Yeah, it's (mostly) this rule that makes the solution complicated. Essentially you need one of these rules for each pair of virtual networks, so if you have 10 networks, you'll need 45 rules, for 11 you'll need 55 (in general, for "n" networks, you'll need (n * (n-1) / 2) extra rules). Aside from the extra packet processing overhead caused by the high number of rules needed (which may be completely insignificant), and the necessity to add/remove rules at specific labels rather than just inserting them all at the beginning, there is the issue that currently each iptables rule added for a libvirt network is dependent only on that network, so it's simple to determine which rules to remove when a network is destroyed. If we start adding rules that are dependent on two networks, then proper cleanup will be more complicated. None of that should prevent a properly motivated person from writing the code to do it, of course!