Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

How can I properly add basic network filters (clean-traffic or, at least, ip-spoofing prevention) to XEN (xend) guests managed by libvirt?

Or, in particular, can I manually execute libvirt's nwfilters from a script (for given parameters)?

I am using libvirt's network to create the bridge (default, bridge virbr0), but, apparently, the xen's vif-bridge script is used to initialize the virtualized system's networking, and libvirt drops nwfilter definitions in domain's xml (probably because it is converted to xen's native config).

share|improve this question
I've run into the same problem – did you find any solution? –  Creshal Jun 19 '13 at 14:27
No, it appears that the only solution is to write the iptables/ebtables security filtering manually. –  HoverHell Jun 19 '13 at 17:44
Which XEN-version and which linux distribution/version? –  Nils Jun 20 '13 at 11:37
Debian stable, i.e. xen 4.1.4, libvirt 0.9.12. –  HoverHell Jun 20 '13 at 14:45
I should note, what I was hoping for is a way to invoke libvirt's filter addition/removal/reconfigure from the commandline; there doesn't seem to be a way, but it is also possible that someone familiar with libvirt's innards could implement that relatively easily. –  HoverHell Jun 23 '13 at 17:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.