Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Similar to this old request on BugZilla for Fedora 8, I'm hoping something has changed since then or someone knows another way.

I want to manage the iptables rules by hand—the one-size-fits-all automatic rules don't suit me at all. These rules seem to be added and removed when a network is started and destroyed. Is there a way of either preventing these rules being added at all or hooking a script into the network start that restores the default rules afterwards.

For now, I'm using a very crude method with cron, but I hope there is a better way:

  *  *  *  *  * root    iptables-restore < /etc/sysconfig/iptables
share|improve this question
Is KVM using a modular script to start virtual network devices? If so you could manipulate that script (this is how I would do this on XEN). – Nils Dec 10 '12 at 14:56
I don't think so but tbh I'm not sure how to find out. – Jack Douglas Dec 10 '12 at 17:38
The best place to ask is the libvirt devel list or on their IRC channel (#virt on OFTC) – dyasny Dec 10 '12 at 21:52
up vote 2 down vote accepted

Well I've found an answer that suits me: I've gone back to school and learned to do it the old fashioned way. No need to use libvirt's fancy networking functions as I can just:

  • set up my own bridged network(s) (not attached to any physical network port)
  • use a DHCP server on the host and masquerade in iptables
  • edit the libvirt guest config files to use the bridge(s)
  • have complete flexibility in how I want to configure security with iptables
share|improve this answer
+1 just use bridged mode, or move on to 802.1Qbg/h – dyasny Dec 10 '12 at 21:53

Jack's answer is a good solution. For step-by-step instructions on how to do it, see the Custom NAT-based Network on this libvirt Networking Handbook.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.