[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [libvirt-users] nwfilter usage

On Wed, May 28, 2014 at 10:13:14AM -0400, Brian Rak wrote:
> On 5/28/2014 10:10 AM, Laine Stump wrote:
> >On 05/27/2014 02:46 AM, Brian Rak wrote:
> >>Make sure you have:
> >>
> >>/proc/sys/net/bridge/bridge-nf-call-iptables = 1
> >That doesn't make sense. bridge-nf-call-iptables controls whether or not
> >traffic going across a Linux host bridge device will be sent through
> >iptables, but the rules created by nwfilter are applied to the "vnetX"
> >tap devices that connect the guest to the bridge, not to the bridge itself.
> It may not make sense to you, but that is what's necessary for nwfilter to
> work.  You can even look at the code:
> http://libvirt.org/git/?p=libvirt.git;a=blob;f=src/nwfilter/nwfilter_ebiptables_driver.c;h=5cb0b74aaec2a659fb6e4b61502ef1322131c056;hb=HEAD#l3127

You are both right and both wrong :-P

The nwfilter code does need nf-call-iptables==1, but if-and-only-if
the nwfilter rule specified in the XML is filtering at the IPv4/IPv6
layer protocol. Any rules which are ethernet layer don't care about
these sysctl settings.

See this:


mac, vlan, stp, arp, rarp, ipv4 and ipv6 protocols are all done at
the ethernet layer.  tcp, udp, sctp, icmp, igmp, esp, ah, udplite
(and their IPv6 variants) are all done at the IP layer.

|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]