[Libvir] [PATCH] Re: iptables masquerade rule overexpansive

[Daniel P. Berrange]

On Thu, Mar 27, 2008 at 03:35:54PM -0500, Charles Duffy wrote:
> Daniel P. Berrange wrote:
> >Instead of having the separate ACCEPT rule I think it would be sufficient
> >to replace  the 0.0.0.0/0 target with  ! 192.168.65.0/24, eg
> >
> >iptables -t nat -A POSTROUTING
> >                --source 192.168.65.0/24 
> >                --destination ! 192.168.65.0/24
> >                -j MASQUERADE
> >
> >so it will masquerade traffic which is leaving the ip range of the virtual
> >network only, and leave ip traffic between the VMs & VM<->host alone.
> 
> I considered that -- but while it will work as long as the default 
> forward rule is ACCEPT, it could result in hosts being unable to 
> communicate with each other if the default rule for the table is otherwise.
> 
> That said, it's certainly easier... patch attached.

I've applied this patch to CVS,

Regards,
Dan.
-- 
|: Red Hat, Engineering, Boston   -o-   http://people.redhat.com/berrange/ :|
|: http://libvirt.org  -o-  http://virt-manager.org  -o-  http://ovirt.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: GnuPG: 7D3B9505  -o-  F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|