<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
...also, it appears that the hook script /etc/libvirt/hooks/daemon to be called when the libvirt daemon is started is actually called _before_ libvirt adds its own iptables rules, because I am not able to insert my custom rule at the top of the chain.<br>
</blockquote><div><br></div><div>how about this daemon hook script?</div><div><pre class="" style="color:rgb(0,0,0);font-size:12px">#!/bin/bash
#
insert_rule() {
sleep 2
iptables -t nat -D CUSTOM_RULE
iptables -t nat -I CUSTOM_RULE
}
case $2 in
start|reload)
insert_rule >/dev/null 2>&1 &
;;
*)
:
;;
esac</pre></div><div> </div></div></div></div>