[libvirt-users] Modify Iptables Rules (virbr0 & virbr1)

[Jorge Fábregas]

On 07/31/2013 11:01 AM, Jorge Fábregas wrote:
> That is, the first network can reach all other networks (just because it
> happens to be the first one defined).  Is this the intention (only
> default can talk to the others but not the other way around)?

*Bump*

I found this excellent post by Daniel Berrange:

http://www.redhat.com/archives/libvir-list/2010-June/msg00762.html

...which explains all the firewall rules that libvirt creates based on
the type of network you choose.  Reading this I get the idea that, the
intention for NAT virtual-networks, is to allow them to communicate with
ANY other virtual-network on your system (since there's an allow rule
for traffic coming out of it).

In a nutshell, the problem is that there's a lack of consistency on how
NAT virtual-networks communicate between each other. I think the traffic
between these subnets should be either allowed or denied.  Right now we
have a mixed scenario where the decision to allow or deny the traffic is
merely based on what position, of the firewall rules, your
virtual-network happens to be.

Here's what I mean:

http://fpaste.org/30485/

Network 0 can reach any network due to line #3

Network 1 can only reach the networks defined below it (due to line #10)
Network 1 can't reach Network 0 due to line #5

Network 2 can't reach any of the above networks due to #line 5 & 12

(reach = "initiate new connections")

Summary:  (Based on the order of firewall rules): virtual-networks can
successfully initiate new connections to the networks defined below it
but can't with networks defined above it.

Comments are welcome.

Thanks!
Jorge