[libvirt-users] Best practice for custom iptables rules

[Gao Yongwei]

> ...also, it appears that the hook script /etc/libvirt/hooks/daemon to be
> called when the libvirt daemon is started is actually called _before_
> libvirt adds its own iptables rules, because I am not able to insert my
> custom rule at the top of the chain.
>

how about this daemon hook script?

#!/bin/bash
#
insert_rule() {
    sleep 2
    iptables -t nat -D CUSTOM_RULE
    iptables -t nat -I CUSTOM_RULE
}


case $2 in
    start|reload)
        insert_rule  >/dev/null 2>&1 &
        ;;
    *)
        :
        ;;
esac
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/libvirt-users/attachments/20140113/e803bf04/attachment.htm>