[libvirt-users] KVM + libvirt + nftables without iptables?

Roman Vesely roman at liten.cz
Thu Oct 18 21:09:55 UTC 2018


Michal Privoznik <mprivozn at redhat.com> wrote:

> On 10/18/2018 10:14 AM, Daniel P. Berrangé wrote:
> > On Wed, Oct 17, 2018 at 05:57:11PM +0200, Roman Vesely wrote:  
> >> Hi everyone,
> >>
> >> I use Debian 9.5 Stretch and NFTABLES as a firewall.
> >> Using NFTABLES  together with IPTABLES is not recommended,
> >> but libvirt depends on IPTABLES.
> >>
> >> Is it safe to run libvirt + kvm + virsh without IPTABLES?
> >>
> >> By the doc https://libvirt.org/firewall.html,
> >> IPTABLES are used for settingup filtering which I do not need.  
> > 
> > Currently it is *NOT* ok.  
> 
> Pardon me if I misread the question but I think Roman is actually
> asking if he turns off iptables in libvirt.

Thank you Michal, you said it exactly.
I only use nftables.
I need to remove iptables and set libvirt to work without them.

> Well, that would work but
> all the forwarding rules, rules that prevent one domain to see
> traffic of the other, etc - you would have to do them yourself. Or
> trust your guests.

Yes, I understand and I will create rules manually with NFTABLES.
And I also manage all kvm guests.

I've found some tips on how to "turn off" iptables in libvirt:

 virsh net-destroy default
 virsh net-autostart --disable default

Is this the right and safe way to remove all dependency to iptables?

Thank you,

Roman




More information about the libvirt-users mailing list