Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Virtual machines (KVM/libvirt) fail to obtain a dynamic IP address from the libvirt-launched dnsmasq running on a CentOS host when the firewall is running. When I turn off the firewall (CSF), the virtual machine obtains an IP. For those who have encountered similar, what worked for you?

I have tried custom iptables rules (INPUT OUTPUT and FORWARD) in

/sbin/iptables -A INPUT  -j ACCEPT -s $SUBNET_PRIVATE -i $IF_TUN_0  
/sbin/iptables -A OUTPUT -j ACCEPT -s $SUBNET_PRIVATE -o $IF_TUN_0  
/sbin/iptables -A FORWARD -i $IF_TUN_0 -o $IF_ETH_0 -j ACCEPT  
/sbin/iptables -A FORWARD -i $IF_ETH_0 -o $IF_TUN_0 -j ACCEPT

I have tried entries in csf.allow.

#allow dnsmasq to serve dynamic IPs to virtual machines on local subnet 

What essential step(s) have I overlooked?

share|improve this question
Configuration of UDP port ranges used by dnsmasq are missing in the origninal post. – composer Dec 3 '09 at 23:37
up vote 1 down vote accepted

After determining how to open up everything...

/sbin/iptables -A INPUT  -j ACCEPT -p all -s 0/0 -i $IF_TUN_0
/sbin/iptables -A OUTPUT -j ACCEPT -p all -s 0/0 -o $IF_TUN_0

The clue came from /var/log/messages. Ports 67 and 68 were blocked.

# allow broadcasted dhcp requests, IP is unknown hence all zero'd
/sbin/iptables -A INPUT  -j ACCEPT -p udp -d 0/0 -i $IF_TUN_0 --dport 67 --sport 68
# allow dhcp renewal requests, the IP is known at this point
/sbin/iptables -A INPUT  -j ACCEPT -p udp -d $IP_PRIVATE_HOST -i $IF_TUN_0 --dport 68 --sport 67

# allow dhcp acks
/sbin/iptables -A OUTPUT  -j ACCEPT -p udp -s $IP_PRIVATE_HOST -o $IF_TUN_0 --dport 68 --sport 67
# allow dhcp renewal response
/sbin/iptables -A OUTPUT  -j ACCEPT -p udp -s $IP_PRIVATE_HOST -o $IF_TUN_0 --dport 67 --sport 68
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.