[Libvir] Virtual network iptables rules
Daniel P. Berrange
berrange at redhat.com
Thu Apr 5 10:59:35 UTC 2007
On Thu, Apr 05, 2007 at 08:28:57AM +0100, Mark McLoughlin wrote:
> Hi Dan,
> On Thu, 2007-04-05 at 02:44 +0100, Daniel P. Berrange wrote:
> > Warning, this is a long & complicated email with lots of horrible details :-)
> > I've long been a little confused with the way iptables & bridging interacts,
> > so set out to do some experiments. I added a -j LOG rule to every single chain
> > in both the filter & nat tables, and then tried various traffic patterns, to
> > see which chains were traversed & in which order.
> Nice work ...
> > Scenario 2: Virtual network
> > ===========================
> > net.bridge.bridge-nf-call-iptables = 1
> > Host: eth0 -> Internet
> > virbr0 -> MASQUERADE to eth0
> > Guest: vif1.0 -> virbr0
> > Traffic: Guest -> Google
> > ------------------------
> > Out:
> > NAT-PREROUTING IN=virbr0 OUT= PHYSIN=vif1.0 SRC=192.168.122.47 DST=220.127.116.11
> > FORWARD IN=virbr0 OUT=eth0 PHYSIN=vif1.0 SRC=192.168.122.47 DST=18.104.22.168
> > NAT-POSTROUTING IN= OUT=eth0 PHYSIN=vif1.0 SRC=192.168.122.47 DST=22.214.171.124
> This really suprises me - I would have expected another one like:
> FORWARD IN=virbr0 OUT=virbr0 PHYSIN=vif1.0 PHYSOUT=virb0 SRC=192.168.122.47 DST=126.96.36.199
> Is it because the packets are coming in on bridge interface we don't
> see any physdev matching? So, we would see it with Guest->Guest?
I'll check up on the DomU<->DomU case - that may well exhibit a FORWARD traversal with
both a PHYSIN & PHYSOUT match.
> > For virtual networks there are basically 3 types of networking config we need to represent
> > in terms of iptables rules, and these need to work for scenrios 1 & 2 - ie regardless of
> > the magic sysctl knob.
> Well, IMHO, we should never be switching off the sysctl knob ourselves
> - i.e. we shouldn't have it in xen/scripts/network-bridge - but I take
> the point that a user might switch it off.
Yeah, I don't much like it either, but the Fedora Xen bridge scripts turn the
setting off - principally so that traffic for bridged guests doesn't get hit
by the Dom0 iptables rules.
> > Problem: The INPUT rules are missing altogether for the isolated virtual network
> > so potentially DHCP/DNS will be blocked
> > Solution: Add them - simple bug.
> I fixed this in CVS, didn't I?
Yeah - I was comparing against the official 0.2.1 release which I happen to have
an RPM installed of.
|=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=|
|=- Perl modules: http://search.cpan.org/~danberr/ -=|
|=- Projects: http://freshmeat.net/~danielpb/ -=|
|=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|
More information about the libvir-list