[libvirt-users] Default firewall rules and forwarding to a guest
Hello, I am trying to understand how libvirt firewall rules are loaded as I have firewalld and iptables services are disabled. Where is the configuration files for firewall and NAT rules for libvirt? How can I load default firewall rules if I mess things up Also I have realized that followings is default ACCEPT all -- 0.0.0.0/0 192.168.122.0/24 ctstate RELATED,ESTABLISHED but If I am to forward a port for a real IP to internal guest machine I need ACCEPT all -- 0.0.0.0/0 192.168.122.0/24 state NEW,RELATED,ESTABLISHED (NEW state is required) and also of course a forwarding rule iptables -t nat -I PREROUTING -p tcp --dport 3389 -j DNAT --to-destination 192.168.122.16:3389 Is there a place I can make this rules static with LibVirt (not playing with firewalld and/or iptables service for Centos 7) Regards.
On 12/22/2016 09:48 AM, Omer Aldemir wrote:
Hello,
I am trying to understand how libvirt firewall rules are loaded as I have firewalld and iptables services are disabled.
libvirt will add its iptables rules via firewalld if firewalld is enabled and running, otherwise it executes iptables commands directly. w
Where is the configuration files for firewall and NAT rules for libvirt?
There are no configuration files for the iptables rules that libvirt adds. The simple set of rules that is added is fixed for each type of libvirt network - NAT, routed, and isolated. Here is a description of exactly what is added for each of these types of network: https://libvirt.org/firewall.html (actually I just realized that I forgot to add information there about a new network forwarding type I recently added - "open", which doesn't add *any* iptables rules - this is intended for those who want to do their own iptables setup for libvirt networks, outside of libvirt.)
How can I load default firewall rules if I mess things up
To reload all the iptables rules for all active libvirt networks, just restart the libvirtd service.
Also I have realized that followings is default
ACCEPT all -- 0.0.0.0/0 192.168.122.0/24 ctstate RELATED,ESTABLISHED
but If I am to forward a port for a real IP to internal guest machine I need
ACCEPT all -- 0.0.0.0/0 192.168.122.0/24 state NEW,RELATED,ESTABLISHED
(NEW state is required) and also of course a forwarding rule
iptables -t nat -I PREROUTING -p tcp --dport 3389 -j DNAT --to-destination 192.168.122.16:3389
Is there a place I can make this rules static with LibVirt (not playing with firewalld and/or iptables service for Centos 7)
The best that can be done with current libvirt is to create a "hook" script similar to the one described here: https://wiki.libvirt.org/page/Networking#Forwarding_Incoming_Connections (That worked the last time I tried it, but that was at least 3 years ago. The python script available as a link from that page is newer and promises to be easier to understand (maybe))
Thanks for the answers i think open network type is not available yet on the version that comes with rhel7 On 3 Jan 2017, at 22:06, Laine Stump <laine@laine.org<mailto:laine@laine.org>> wrote: On 12/22/2016 09:48 AM, Omer Aldemir wrote: Hello, I am trying to understand how libvirt firewall rules are loaded as I have firewalld and iptables services are disabled. libvirt will add its iptables rules via firewalld if firewalld is enabled and running, otherwise it executes iptables commands directly. w Where is the configuration files for firewall and NAT rules for libvirt? There are no configuration files for the iptables rules that libvirt adds. The simple set of rules that is added is fixed for each type of libvirt network - NAT, routed, and isolated. Here is a description of exactly what is added for each of these types of network: https://libvirt.org/firewall.html (actually I just realized that I forgot to add information there about a new network forwarding type I recently added - "open", which doesn't add *any* iptables rules - this is intended for those who want to do their own iptables setup for libvirt networks, outside of libvirt.) How can I load default firewall rules if I mess things up To reload all the iptables rules for all active libvirt networks, just restart the libvirtd service. Also I have realized that followings is default ACCEPT all -- 0.0.0.0/0 192.168.122.0/24 ctstate RELATED,ESTABLISHED but If I am to forward a port for a real IP to internal guest machine I need ACCEPT all -- 0.0.0.0/0 192.168.122.0/24 state NEW,RELATED,ESTABLISHED (NEW state is required) and also of course a forwarding rule iptables -t nat -I PREROUTING -p tcp --dport 3389 -j DNAT --to-destination 192.168.122.16:3389 Is there a place I can make this rules static with LibVirt (not playing with firewalld and/or iptables service for Centos 7) The best that can be done with current libvirt is to create a "hook" script similar to the one described here: https://wiki.libvirt.org/page/Networking#Forwarding_Incoming_Connections (That worked the last time I tried it, but that was at least 3 years ago. The python script available as a link from that page is newer and promises to be easier to understand (maybe))
On 01/03/2017 06:44 PM, Omer Aldemir wrote:
Thanks for the answers i think open network type is not available yet on the version that comes with rhel7
Actually it is in RHEL 7.3. Although the feature is in upstream libvirt only starting in version 2.2.0, and RHEL7.3 libvirt is based on libvirt 2.0.0, certain patches are backported into RHEL packages based on severity of bug vs. potential for introducing regressions vs. customer demand. This particular patch was backported into RHEL7.3 for https://bugzilla.redhat.com/846810
On 3 Jan 2017, at 22:06, Laine Stump <laine@laine.org <mailto:laine@laine.org>> wrote:
On 12/22/2016 09:48 AM, Omer Aldemir wrote:
Hello,
I am trying to understand how libvirt firewall rules are loaded as I have firewalld and iptables services are disabled.
libvirt will add its iptables rules via firewalld if firewalld is enabled and running, otherwise it executes iptables commands directly.
w
Where is the configuration files for firewall and NAT rules for libvirt?
There are no configuration files for the iptables rules that libvirt adds. The simple set of rules that is added is fixed for each type of libvirt network - NAT, routed, and isolated. Here is a description of exactly what is added for each of these types of network:
https://libvirt.org/firewall.html
(actually I just realized that I forgot to add information there about a new network forwarding type I recently added - "open", which doesn't add *any* iptables rules - this is intended for those who want to do their own iptables setup for libvirt networks, outside of libvirt.)
How can I load default firewall rules if I mess things up
To reload all the iptables rules for all active libvirt networks, just restart the libvirtd service.
Also I have realized that followings is default
ACCEPT all -- 0.0.0.0/0 192.168.122.0/24 ctstate RELATED,ESTABLISHED
but If I am to forward a port for a real IP to internal guest machine I need
ACCEPT all -- 0.0.0.0/0 192.168.122.0/24 state NEW,RELATED,ESTABLISHED
(NEW state is required) and also of course a forwarding rule
iptables -t nat -I PREROUTING -p tcp --dport 3389 -j DNAT --to-destination 192.168.122.16:3389
Is there a place I can make this rules static with LibVirt (not playing with firewalld and/or iptables service for Centos 7)
The best that can be done with current libvirt is to create a "hook" script similar to the one described here:
https://wiki.libvirt.org/page/Networking#Forwarding_Incoming_Connections
(That worked the last time I tried it, but that was at least 3 years ago. The python script available as a link from that page is newer and promises to be easier to understand (maybe))
_______________________________________________ libvirt-users mailing list libvirt-users@redhat.com https://www.redhat.com/mailman/listinfo/libvirt-users
participants (2)
-
Laine Stump -
Omer Aldemir