libvirtd and public access to guests

[Bill Davidsen]

Didar Hossain wrote:
> On Thu, Oct 8, 2009 at 3:32 PM, Pavel Lisy <pali at tmapy.cz> wrote:
>> Hello
>>
>> I've started playing with libvirt and I have question?
>>
>> What is proper way to make guest accessible from net.
>>
>> I have mode=nat /var/lib/libvirt/network/default.xml.
>>
>> libvirtd makes this rules in FORWARD chain
>>
>> -A FORWARD -d 192.168.231.0/24 -o virbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT
>> -A FORWARD -s 192.168.231.0/24 -i virbr0 -j ACCEPT
>> -A FORWARD -i virbr0 -o virbr0 -j ACCEPT
>> -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
>> -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
>> -A FORWARD -j REJECT --reject-with icmp-host-prohibited
>>
>> If I add
>> iptables -I FORWARD -i eth0 -o virbr0 -j ACCEPT
>> guests are accessible
>>
>> My question is:
>> Is is possible write this somewhere to configuration?
>>
>> I've tried to put it in /etc/sysconfig/iptables but it libvirtd put his
>> rules before mine.
>>
>>
>> I've found two directories
>> /var/lib/libvirt/iptables/filter
>> /var/lib/libvirt/iptables/nat
> 
> I was hoping someone with more experience would help you on this issue.
> 
> It is better to write your own rules than messing with these files
> (/var/lib/libvirt).
> 
> The default network mode of libvirt is a private network behind NAT.
> The guests are provided
> an IP address via DHCP. If you want a guest to be accessible from the
> Internet then you will
> have to configure static IP in your guest, ensure that you give an IP
> in the 192.168.231.0/24
> range.
> 
> Then you will have to set up DNAT iptable rules. AFAIK, to prevent
> libvirt from overriding your
> rules, you should be using "-I" (INSERT) instead of "-A" (APPEND). Put
> your rules in the file
> /etc/sysconfig/iptables
> 
> This is the theory. I *do not* use libvirt. I use VDE for my
> networking with command line KVM.
> 
I set mine up to pass through to the DHCP server in the outside world, and 
identify the VM by using a MAC address setting so DHCP can assign the IP. If for 
any reason I need to change IP addressing I can do it all in the dhcpd.conf 
file. I'm also using KVM from the command line, with startup scripts, and I 
define my own bridge and add the external NIC to that.

Another of the many possible ways to address having servers in a VM.

-- 
Bill Davidsen <davidsen at tmr.com>
   "We have more to fear from the bungling of the incompetent than from
the machinations of the wicked."  - from Slashdot