4

I've set up a number of guests running on kvm on Ubuntu. Network access for the guests is via network bridge with br0 sitting on top of eth0. I have ufw running on the host machine and this is restricting traffic to the host. Is there a way to make the rules on the host apply to all the guests, so blocking a port on the host firewall would prevent access on all the guests?

2 Answers 2

2

I'm not sure about ufw specifically, but I can block / filter ports to guests by using iptables on the host. You must add the rules to the FORWARD chain. If you can access the FORWARD chain from ufw, then add your rules to it, and they should apply to the guests as well.

1

Try with

ufw route deny in on br0 out on br0 to any <portnumber> proto <tcp|udp|all>

(I have a scenario like yours except for a "default outgoing drop" ufw setting, so my VMs are completely locked except for the ports that I explicitly allow, using a command like the above with allow instead of deny)

(Please note that if you are on kernel >= 3.18 you have to load the br_netfilter module)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .