<div dir="ltr"> <div class="gmail_extra"> <div class="gmail_quote">2013/7/8 Sven Schwedas <<a href="mailto:sven.schwedas@tao.at" target="_blank">sven.schwedas@tao.at</a>> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"> Hi, I'm trying to configure nwfilter for KVM, but so far I haven't managed to figure out a working configuration. Network setup: The dom0 (Debian 7.1, kernel 3.2.46-1, libvirt 0.9.12) is connected via eth0, part of the external subnet <a href="http://192.168.17.0/24" target="_blank">192.168.17.0/24</a>, and has an additional subnet <a href="http://192.168.128.160/28" target="_blank">192.168.128.160/28</a> routed to its main address 192.168.17.125. The host's subnet is configured as bridge in virsh: > <network> > <name>foo</name> > <forward dev='eth0' mode='route'> > <interface dev='eth0'/> > </forward> > <bridge name='foo-br0' stp='off' delay='0' /> > <ip address='192.168.128.161' netmask='255.255.255.240'> > </ip> > </network> The domU is configured to use this bridge (static IP configured in DomU): > <interface type='network'> > <source network='foo'/> > <target dev='vnet0'/> > <model type='virtio'/> > <filterref filter='test-eth0'> > <parameter name='CTRL_IP_LEARNING' value='none'/> > <parameter name='IP' value='192.168.128.162'/> > </filterref> > <alias name='net0'/> > <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> > </interface> With an empty filter, connectivity is working fine. Now, if I add the example ruleset suggested in the documentation ( <a href="http://libvirt.org/formatnwfilter.html#nwfwriteexample" target="_blank">http://libvirt.org/formatnwfilter.html#nwfwriteexample</a> ), *incoming* ICMP works (but not outgoing), and inbound SSH traffic is blocked, together with outbound DNS. The linked rules produce the following iptables chains: > Chain INPUT (policy ACCEPT) > target prot opt source destination > libvirt-host-in all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> > ACCEPT udp -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> udp dpt:53 > ACCEPT tcp -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> tcp dpt:53 > ACCEPT udp -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> udp dpt:67 > ACCEPT tcp -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> tcp dpt:67 > > Chain FORWARD (policy ACCEPT) > target prot opt source destination > libvirt-in all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> > libvirt-out all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> > libvirt-in-post all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> > ACCEPT all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://192.168.128.160/28" target="_blank">192.168.128.160/28</a> > ACCEPT all -- <a href="http://192.168.128.160/28" target="_blank">192.168.128.160/28</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> > ACCEPT all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> > REJECT all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> reject-with icmp-port-unreachable > REJECT all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> reject-with icmp-port-unreachable > > Chain OUTPUT (policy ACCEPT) > target prot opt source destination > > Chain FI-vnet0 (1 references) > target prot opt source destination > RETURN tcp -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> tcp spt:22 state ESTABLISHED ctdir ORIGINAL > RETURN tcp -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> tcp spt:80 state ESTABLISHED ctdir ORIGINAL > RETURN icmp -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> state NEW,ESTABLISHED ctdir REPLY > RETURN udp -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> udp dpt:53 state NEW,ESTABLISHED ctdir REPLY > DROP all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> > > Chain FO-vnet0 (1 references) > target prot opt source destination > ACCEPT tcp -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> tcp dpt:22 state NEW,ESTABLISHED ctdir REPLY > ACCEPT tcp -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> tcp dpt:80 state NEW,ESTABLISHED ctdir REPLY > ACCEPT icmp -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> state ESTABLISHED ctdir ORIGINAL > ACCEPT udp -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> udp spt:53 state ESTABLISHED ctdir ORIGINAL > DROP all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> > > Chain HI-vnet0 (1 references) > target prot opt source destination > RETURN tcp -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> tcp spt:22 state ESTABLISHED ctdir ORIGINAL > RETURN tcp -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> tcp spt:80 state ESTABLISHED ctdir ORIGINAL > RETURN icmp -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> state NEW,ESTABLISHED ctdir REPLY > RETURN udp -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> udp dpt:53 state NEW,ESTABLISHED ctdir REPLY > DROP all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> > > Chain libvirt-host-in (1 references) > target prot opt source destination > HI-vnet0 all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> [goto] PHYSDEV match --physdev-in vnet0 > > Chain libvirt-in (1 references) > target prot opt source destination > FI-vnet0 all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> [goto] PHYSDEV match --physdev-in vnet0 > > Chain libvirt-in-post (1 references) > target prot opt source destination > ACCEPT all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> PHYSDEV match --physdev-in vnet0 > > Chain libvirt-out (1 references) > target prot opt source destination > FO-vnet0 all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> [goto] PHYSDEV match --physdev-out vnet0 I've tried fidgeting with the configuration (direction inout instead of in/out, etc.), but I didn't find a setup that works as intended. What am I missing?</blockquote><div style>I always use ebtables instead of iptables and everything works fine for me. </div><div style>ebtables works with mac stp vlan arp rarp ipv4 ipv6 , tcp udp works with iptables. </div> </div></div></div>