[libvirt-users] Easy solution for custom firewall rules-

Joshua Kramer joskra42.list at gmail.com
Mon Jun 3 02:02:21 UTC 2019

Nakta wrote:
> libvirts nwfilter module can achieve that.

I read over those resources and I did what I thought would be correct,
but it's not having any effect.

I created a new nwfilter like this:
<filter name='allow-virbr2-vpn' chain='ipv4' priority='-700'>
  <rule action='accept' direction='in' priority='500'>
    <all state='ESTABLISHED'/>
  <rule action='accept' direction='out' priority='500'>
    <all state='ESTABLISHED,RELATED'/>
  <rule action='accept' direction='in' priority='100'>
    <ip dstipaddr='' dstipmask='24'/>
  <rule action='accept' direction='out' priority='100'>
    <ip srcipaddr='' srcipmask='24'/>
  <rule action='drop' direction='inout' priority='500'>

I then associated that filter with the Interface device on the VM
server within KVM... and shutdown/restart that VM.
 <interface type='network'>
      <mac address='XX:XX:XX:XX:XX:XX'/>
      <source network='locservers'/>
      <model type='virtio'/>
      <filterref filter='allow-virbr2-vpn'/>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x03'

After this, nothing happens.  I did 'ebtables --list', and the new
rules aren't there.  I also did the same with iptables as well as
firewalld itself.  The new rules are nowhere to be found.

What did I do incorrectly here?


More information about the libvirt-users mailing list