[libvirt] Proposed: always allow packets internal to an interface
Eric Blake
eblake at redhat.com
Mon Nov 5 16:34:49 UTC 2012
On 11/04/2012 10:18 AM, Gene Czarcinski wrote:
> On 11/02/2012 07:46 AM, Gene Czarcinski wrote:
>> Currently, when an interface (virtual network) is started, if no ip
>> address is defined, then no rule is added to bemit "internal" network
>> traffic. However, virtual guests can use such a network to
>> communicate if a rule is added to the iptables/ip6tables rule set.
>> This will work even if no ip address is defined on an interface (which
>> is valid).
>>
>> I propose that rules of the following forms be added when an interface
>> is started and removed when it is destroyed:
>>
>> iptables -I FORWARD 1 -i virbr18 -o virbr18 -j ACCEPT
>>
>> ip6tables -I FORWARD 1 -i virbr18 -o virbr18 -j ACCEPT
I'm not as familiar with this as others, so I'll defer on whether this
makes sense.
>>
>> If a user wants a "very private network", the user has to run the
>> above commands. The proposal simply does this automatically.
> It appears that this patch is not necessary since I can do this now
> using nwfilters.
>
> Question: I see little discussed or anything about nwfilters. Is
> nwfilters an active concept or is it still included because of legacy?
> Will this still work with firewalld?
But this I can answer. Yes, nwfilters is still an actively maintained
concept, and yes, it is supposed to work with firewalld.
--
Eric Blake eblake at redhat.com +1-919-301-3266
Libvirt virtualization library http://libvirt.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 617 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20121105/efb6bba1/attachment-0001.sig>
More information about the libvir-list
mailing list