<div dir="ltr"><br><br><div class="gmail_quote">---------- Forwarded message ----------<br>From: <b class="gmail_sendername">mallapadi niranjan</b> <span dir="ltr"><<a href="mailto:niranjan.ashok@gmail.com">niranjan.ashok@gmail.com</a>></span><br> Date: Mon, Nov 19, 2012 at 7:30 PM<br>Subject: Re: [libvirt-users] unable to ping from guests in virbr0 to guests in virbr1 network<br>To: Marwan Tanager <<a href="mailto:marwan.tngr@gmail.com">marwan.tngr@gmail.com</a>><br> <br><br><br><br><div class="gmail_quote"><div><div class="h5">On Mon, Nov 19, 2012 at 7:51 PM, Marwan Tanager <span dir="ltr"><<a href="mailto:marwan.tngr@gmail.com" target="_blank">marwan.tngr@gmail.com</a>></span> wrote:<br> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <div>On Mon, Nov 19, 2012 at 12:09:53PM +0530, mallapadi niranjan wrote:<br> </div><div><div>> Hi all,<br> ><br> > I have 3 guests (2-RHEL4 and 1 RHEL6) and have some issues regarding<br> > networking between them. The 2 RHEL4 system's use default bridge virbr0 and<br> > get ip's of range <a href="http://192.168.122.0/24" target="_blank">192.168.122.0/24</a> (192.168.122.207, 192.168.122.167)<br> ><br> > I created another bridge (virbr1) with NAT forwarding (no dhcp). The<br> > network i choose was <a href="http://192.168.100.0/24" target="_blank">192.168.100.0/24</a>. And the third system (RHEL6) was<br> > assigned static ip-addres 192.168.100.101,<br> ><br> > >>From the RHEL6 system which uses virbr1 is able to ping systems in<br> > <a href="http://192.168.122.0/24" target="_blank">192.168.122.0/24</a> series , but guest systems in <a href="http://192.168.122.0/24" target="_blank">192.168.122.0/24</a> are not<br> > able to ping RHEL6 system (in virbr1) network.<br> ><br> > >>From the RHEL4 guests i am able to ping the gateway ip's (192.168.122.1,<br> > 192.168.100.1) , but not the RHEL6 system<br> ><br> ><br> > Versions:<br> > Fedora release 16 (Verne)<br> > libvirt-0.9.6.3-1.fc16.x86_64<br> > qemu-kvm-0.15.1-8.fc16.x86_64<br> ><br> > Any hints on what could be the problem<br> <br> </div></div>The problem is caused by the relative order of the iptables rules for those two<br> networks.<br> <br> When libvirt created virbr1 for the network <a href="http://192.168.100.0/24" target="_blank">192.168.100.0/24</a> it inserted a<br> couple of iptables rules on the FORWARDING chain for this interface, but it<br> added them before the rules of virbr0 on the same chain. Those rules basically<br> are ordered as follows (at least on my system which I suspect is different from<br> yours since I also had the same problem):<br> <br> 1. Forward packets destined for the interface that are part of an established<br> connection.<br> 2. Forward packets coming from the interface.<br> 3. Forward packets coming from and destined to the same interface (loopback).<br> 4. Reject forwarding anything else to the interface.<br> 5. Reject forwarding anything else from the interface.<br></blockquote></div></div><div><br>okay that seems to be the behaviour:<br>hain FORWARD (policy ACCEPT)<br>target prot opt source destination <br> ACCEPT all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://192.168.100.0/24" target="_blank">192.168.100.0/24</a> state RELATED,ESTABLISHED<br> ACCEPT all -- <a href="http://192.168.100.0/24" target="_blank">192.168.100.0/24</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <br>ACCEPT all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <br> REJECT all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> reject-with icmp-port-unreachable<br>REJECT all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> reject-with icmp-port-unreachable<br> ACCEPT all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://192.168.200.0/24" target="_blank">192.168.200.0/24</a> state RELATED,ESTABLISHED<br>ACCEPT all -- <a href="http://192.168.200.0/24" target="_blank">192.168.200.0/24</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <br> ACCEPT all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <br>REJECT all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> reject-with icmp-port-unreachable<br> REJECT all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> reject-with icmp-port-unreachable<br>ACCEPT all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://192.168.122.0/24" target="_blank">192.168.122.0/24</a> state RELATED,ESTABLISHED<br> ACCEPT all -- <a href="http://192.168.122.0/24" target="_blank">192.168.122.0/24</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <br>ACCEPT all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <br> REJECT all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> reject-with icmp-port-unreachable<br>REJECT all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> reject-with icmp-port-unreachable<br> REJECT all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> reject-with icmp-host-prohibited<br><br>I can ping from <a href="http://192.168.100.0/24" target="_blank">192.168.100.0/24</a> -> <a href="http://192.168.122.0/24" target="_blank">192.168.122.0/24</a> (but not the viceversa)<br> <br> <br></div><div class="im"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <br> Since those rules are inserted for every interface libvirt adds in this order,<br> you can only ping from one interface to another if the set of rules for the<br> interface you are pinging from comes before that of the one you're pinging to.<br> Otherwise, rule number 4 of the destination interface will get in the way since<br> iptables matches the packets against the rules in a chain according to their<br> order on it.<br> <br> A possible workaround:<br> <br> iptables-save >/path/to/iptables/dump/file<br> <br> then, edit the file to move all relevant rules that REJECT things on the<br> FORWARDING chain to the end of the chain.<br> <br> then put this command in your rc.local script:<br> <br> cat /path/to/iptables/dump/file | iptables-restore<br> <br> This solution is not reliable though because you will need to update the file<br> containing the rules every time you add a new virtual network or update the<br> iptables rules for some other reason.<br></blockquote></div><div><br>Right , <br> <br></div><div class="im"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <br> Also, I hinted before at this problem on the list and someone pointed me that<br> it's a bug, but nobody confirmed. Read my message on this topic with the<br> subject: Inconsistent iptables forwarding rules for virtual networks, to get a<br> clearer picture.<br> <span><font color="#888888"><br></font></span></blockquote></div><div>Okay, will look in to that mail <br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <span><font color="#888888"> <br> Marwan<br> </font></span></blockquote></div><br> </div><br></div>