<div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div>Hi Sam,</div><div> <br></div><div>You can find the rules by below command, and it looks as below:</div><div><div># ebtables -t nat --list</div><div>Bridge table: nat</div><div><br></div><div>Bridge chain: PREROUTING, entries: 2, policy: ACCEPT</div><div>-j PREROUTING_direct</div><div>-i vnet0 -j libvirt-I-vnet0</div><div><br></div><div>Bridge chain: OUTPUT, entries: 1, policy: ACCEPT</div><div>-j OUTPUT_direct</div><div><br></div><div>Bridge chain: POSTROUTING, entries: 2, policy: ACCEPT</div><div>-j POSTROUTING_direct</div><div>-o vnet0 -j libvirt-O-vnet0</div><div><br></div><div>Bridge chain: PREROUTING_direct, entries: 0, policy: RETURN</div><div><br></div><div>Bridge chain: POSTROUTING_direct, entries: 0, policy: RETURN</div><div><br></div><div>Bridge chain: OUTPUT_direct, entries: 0, policy: RETURN</div><div><br></div><div>Bridge chain: libvirt-I-vnet0, entries: 9, policy: ACCEPT</div><div>-j I-vnet0-mac</div><div>-p IPv4 -j I-vnet0-ipv4-ip</div><div>-p IPv4 -j ACCEPT </div><div>-p ARP -j I-vnet0-arp-mac</div><div>-p ARP -j I-vnet0-arp-ip</div><div>-p ARP -j ACCEPT </div><div>-p 0x8035 -j I-vnet0-rarp</div><div>-p 0x835 -j ACCEPT </div><div>-j DROP </div><div><br></div><div>Bridge chain: libvirt-O-vnet0, entries: 4, policy: ACCEPT</div><div>-p IPv4 -j O-vnet0-ipv4</div><div>-p ARP -j ACCEPT </div><div>-p 0x8035 -j O-vnet0-rarp</div><div>-j DROP </div><div><br></div><div>Bridge chain: I-vnet0-mac, entries: 2, policy: ACCEPT</div><div>-s 52:54:0:3a:40:b7 -j RETURN </div><div>-j DROP </div><div><br></div><div>Bridge chain: I-vnet0-ipv4-ip, entries: 3, policy: ACCEPT</div><div>-p IPv4 --ip-src 0.0.0.0 --ip-proto udp -j RETURN </div><div>-p IPv4 --ip-src 172.16.1.2 -j RETURN </div><div>-j DROP </div><div><br></div><div>Bridge chain: O-vnet0-ipv4, entries: 1, policy: ACCEPT</div><div>-j ACCEPT </div><div><br></div><div>Bridge chain: I-vnet0-arp-mac, entries: 2, policy: ACCEPT</div><div>-p ARP --arp-mac-src 52:54:0:3a:40:b7 -j RETURN </div><div>-j DROP </div><div><br></div><div>Bridge chain: I-vnet0-arp-ip, entries: 2, policy: ACCEPT</div><div>-p ARP --arp-ip-src 172.16.1.2 -j RETURN </div><div>-j DROP </div><div><br></div><div>Bridge chain: I-vnet0-rarp, entries: 2, policy: ACCEPT</div><div>-p 0x8035 -s 52:54:0:3a:40:b7 -d Broadcast --arp-op Request_Reverse --arp-ip-src 0.0.0.0 --arp-ip-dst 0.0.0.0 --arp-mac-src 52:54:0:3a:40:b7 --arp-mac-dst 52:54:0:3a:40:b7 -j ACCEPT </div><div>-j DROP </div><div><br></div><div>Bridge chain: O-vnet0-rarp, entries: 2, policy: ACCEPT</div><div>-p 0x8035 -d Broadcast --arp-op Request_Reverse --arp-ip-src 0.0.0.0 --arp-ip-dst 0.0.0.0 --arp-mac-src 52:54:0:3a:40:b7 --arp-mac-dst 52:54:0:3a:40:b7 -j ACCEPT </div><div>-j DROP </div></div><div><br></div>For interface set as:</div><div dir="ltr"><div dir="ltr"> <interface type='bridge'></div><div dir="ltr"> <mac address='52:54:00:3a:40:b7'/></div><div dir="ltr"> <source bridge='br0'/></div><div dir="ltr"> <target dev='vnet0'/></div><div dir="ltr"> <model type='rtl8139'/></div><div dir="ltr"> <filterref filter='clean-traffic'></div><div dir="ltr"> <parameter name='IP' value='172.16.1.2'/></div><div dir="ltr"> </filterref></div><div dir="ltr"> <alias name='net0'/></div><div dir="ltr"> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/></div><div dir="ltr"> </interface></div><div><br></div><div><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><br><br>-------<br>Best Regards,<br>Yalan Zhang<br>IRC: yalzhang<br></div></div></div></div><br></div></div></div></div><br><div class="gmail_quote"><div dir="ltr">On Wed, Dec 26, 2018 at 12:28 AM fatal <<a href="mailto:fatal@mailbox.org">fatal@mailbox.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hello,<br> <br> I'm recently stumbled over the libvirt network filter capabilities and<br> got pretty excited. Unfortunately I'm not able to get the the<br> "clean-traffic" filterset working. I'm using a freshly installed Debian<br> Stretch with libvirt, qemu and KVM.<br> <br> My config snippet looks as follows:<br> <br> sudo virsh edit <VM><br> <br> [...]<br> <interface type='bridge'><br> <mac address='52:54:00:0c:14:07'/><br> <source bridge='br0'/><br> <model type='virtio'/><br> <filterref filter='clean-traffic'><br> <parameter name='IP' value='10.10.1.2'/><br> </filterref><br> <address type='pci' domain='0x0000' bus='0x00' slot='0x03'<br> function='0x0'/><br> </interface><br> <interface type='bridge'><br> <mac address='52:54:00:0c:24:17'/><br> <source bridge='br1'/><br> <model type='virtio'/><br> <filterref filter='clean-traffic'><br> <parameter name='IP' value='172.16.1.2'/><br> </filterref><br> <address type='pci' domain='0x0000' bus='0x00' slot='0x03'<br> function='0x0'/><br> </interface><br> [...]<br> <br> I restarted the VM from within the VM, did a "virsh reboot <VM>",<br> restarted libvirtd and even did a reboot of the host - just to be sure.<br> Unfortunately neither "iptables -L" nor "ebtables --list" show any<br> entries added by libvirt. Also omitting the "parameter name='IP'" part<br> didn't change anything.<br> <br> There are no error messages in /var/log/syslog nor in<br> /var/log/libvirt/qemu/<VM><br> <br> My main references were:<br> <br> <a href="https://libvirt.org/firewall.html" rel="noreferrer" target="_blank">https://libvirt.org/firewall.html</a><br> <a href="https://libvirt.org/formatnwfilter.html" rel="noreferrer" target="_blank">https://libvirt.org/formatnwfilter.html</a><br> <a href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/virtualization_deployment_and_administration_guide/sect-virtual_networking-applying_network_filtering" rel="noreferrer" target="_blank">https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/virtualization_deployment_and_administration_guide/sect-virtual_networking-applying_network_filtering</a><br> <a href="https://www.berrange.com/posts/2011/10/03/guest-mac-spoofing-denial-of-service-and-preventing-it-with-libvirt-and-kvm/" rel="noreferrer" target="_blank">https://www.berrange.com/posts/2011/10/03/guest-mac-spoofing-denial-of-service-and-preventing-it-with-libvirt-and-kvm/</a><br> <br> Any help really would be much appreciated!<br> <br> Thanks a lot!<br> <br> Sam<br> <br> _______________________________________________<br> libvirt-users mailing list<br> <a href="mailto:libvirt-users@redhat.com" target="_blank">libvirt-users@redhat.com</a><br> <a href="https://www.redhat.com/mailman/listinfo/libvirt-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/libvirt-users</a><br> </blockquote></div>