Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Linux machine running KVM with several VM:s, all have public IP:s. For the time being I have everything routed through a bridge (br0) and this works well.

I also need a firewall on the host to restrict access to both the host and the VM:s, I guess we are talking about routing and iptables? I'm not that experienced with iptables/bridging/network stuff and need a point in the right direction.

Any recommendations?

Host: Ubuntu server 11.04, VM: Mixed, Linux and Windows

share|improve this question
I have a working solution, right now. I will update my question (when I have time) with the configuration/rules, or should a answer be more appropriate? – nsg Jul 12 '11 at 12:58

iptables can be set up to check bridge traffic. I usually disable it to improve performance, but you can do the opposite: /etc/sysctl.conf:

net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-arptables = 0

If you set either of these to 1 instead of 0 you'll have the host iptables filtering the traffic for the bridge.

Another solution would be to stop using the bridge, and use libvirts' NAT implementation, which uses iptables as well

EDIT: since both ways are rather faulty IMO, I would run the firewalls in the guests themselves, leaving them on a normal bridged network. or, which would be even more proper, run a separate firewall appliance in front of the virtual infrastructure

share|improve this answer
Ah, nice. I will give the "bridge routing" a try. A separate machine is not a option (cost and limited space). – nsg Jul 4 '11 at 11:47
@nsg: You can run OpenWRT on a low cost router and run the external firewall there. – BillThor Jul 4 '11 at 14:04
A separate physical box is not a option. Limited space/cost. – nsg Jul 12 '11 at 12:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.