[libvirt] libvirt modifying iptables rules

Daniel P. Berrange berrange at redhat.com
Mon Mar 15 16:42:46 UTC 2010


On Sun, Mar 07, 2010 at 07:39:59PM +0530, Varrun Ramani wrote:
> Hi
> 
> I am right now undertaking a project which deals with verification of
> firewall rules. I wish to know which applications/libraries modify/query
> firewall rules. I came to know that libvirt modifies iptables rules. Can
> anyone let me know for what purposes/how libvirt modifies the rules?

The 'virtual network' functionality in libvirt sets up a isolated bridge
device, to which guests are connected. libvirt uses iptables to control
what happens to traffic on that bridge device. Either we stop it leaving
the bridge entirely (only VM<->VM and VM<->host), or allow it to get to
the LAN either routing a subnet, or using NAT to masquerade it. The
rules are written such that they only match traffic relating to the
configured bridge device in libvirt, so they shouldn't expose the rest of
the host interfaces to any new traffic risks

Regards,
Daniel
-- 
|: Red Hat, Engineering, London    -o-   http://people.redhat.com/berrange/ :|
|: http://libvirt.org -o- http://virt-manager.org -o- http://deltacloud.org :|
|: http://autobuild.org        -o-         http://search.cpan.org/~danberr/ :|
|: GnuPG: 7D3B9505  -o-   F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|




More information about the libvir-list mailing list