[libvirt-users] nwfilters seem fundamentally unusable or unfinished

[J Mo]

Hello!

I just spent the last four days working with nwfilters only to decide 
that they are apparently unusable. I've come to the mailing list seeking 
input on this subject.

First off, please forgive my offensiveness. I'm sure people worked hard 
on nwfilters and it looks like a lot of effort went into providing this 
functionality. This is also an extremely difficult subject to get right 
in the many possible use cases, so I'm very sympathetic to how difficult 
it would be to try and implement this. However, the existing system 
didn't work out for me, I've found a number of other people who are 
saying the same thing (it didn't work out for them), and I don't see any 
hope continuing down the path of trying to make it work.

For now, I've given up on nwfilters and I created a hook script that 
works with my existing iptables rules and applies network filter 
policies on specific VM/guests where needed.

If you are doing extensive VM network filtering in your environment, how 
did you do it?

I've listed a bunch of my gripes below. Please correct me if I've gotten 
anything wrong here. I'm new to nwfilters so maybe I overlooked 
something or I might just misunderstand the whole thing and could be 
totally wrong.



The first and primary problem that I have with nwfilters are that the 
documentation is poor. There is very little documentation which exists, 
and that which does exist seems like it was spat out just to fulfill 
business requirements that some documentation be produced, rather than 
an effort into creating good usable documentation. I've run into large 
amounts of undocumented behavior and I don't feel like reading the 
source code any further to figure out what the intent of these tools were.

My second big issue, and a clue very few people actually use nwfilters 
in the wild, is the low quantity of examples and how-to docs I found 
while googling. Complex examples just don't seem to exist. Further, of 
those complex examples I did find, people were often going down the 
route of creating their own hook script programs to replace nwfilters, 
indicating that this isn't just me.

Additionally...

I discovered that nwfilters do not play well with existing system 
iptables/ebtables rules. There is some good examples on this regarding 
Red Hat's firewalld and how libvirt's nwfilters does not play well 
together if you google around a little. It seems like this was just not 
considered in scope, or the assumption was that the local host would not 
have any existing iptables/ebtables rules and that libvirt would have 
complete control over the hypervisor host. There is no documented means 
of controlling where libvirt inserts it's rules into an existing set of 
rules, and libvirt creates numerous rules in both ebtables and iptables, 
making the problem even more complex.

nwfilter seems to have been designed with a bias towards 
user-networking. I am using bridged interfaces, and some features and 
virsh commands don't apply to this mode of operation.

I've been able to produce scenarios where nwfilter would abandon rules 
after changes had been made to running guests, and the only way I could 
get rid of them was manual intervention (iptables/ebtables -F -X).

There is no command/control to apply an existing nwfilter to a running 
guest, or to remove/clear the existing nwfilters on a running guest. 
This item is a huge indication that this isn't a production-ready 
feature set.

I think the worst problem I've run into, however, is that I was able to 
create very simple nwfilters that either broke networking of the 
hypervisor system (stopped all traffic), or failed to drop traffic which 
should have been dropped. I still don't understand why nwfilter is often 
creating rules in the ebtables "nat" table instead of the "filter" 
table, where they belong. That one right there is a huge WTF -- packets 
never get inspected because the rules are in the wrong table!

In general, I found the output iptables/ebables rules that nwfilter 
generated often did not reflect the obvious intent of the rules that 
went into the nwfilter xml configuration. This abstraction layer 
produces unreliable and/or confusing results. I put a series of rules 
into a nwfilter xml file and the iptables/ebtables rules that I get out 
are insane. Nwfilter rules in = mystery meat out.

Priorities are a huge WTF that caused me a lot of grief. Are rules going 
to be assembled in iptables/ebtables in the order which they are 
declared in XML? (this is undocumented) If so, why do priorities exist? 
(undocumented). What is the default priority? Is it zero? (undocumented).

Want to create a filter rule that will log certain packets? Apparently 
there is no logging functionality at all. Can't be done. Anything beyond 
the most basic packet allow/drop (even reject was an afterthought) isn't 
supported by nwfilter rules.

Thanks for reading