Virtual machines (KVM/libvirt) fail to obtain a dynamic IP address from the libvirt-launched dnsmasq running on a CentOS host when the firewall is running. When I turn off the firewall (CSF), the virtual machine obtains an IP. For those who have encountered similar, what worked for you?
I have tried custom iptables rules (INPUT OUTPUT and FORWARD) in csfpost.sh.
/sbin/iptables -A INPUT -j ACCEPT -s $SUBNET_PRIVATE -i $IF_TUN_0
/sbin/iptables -A OUTPUT -j ACCEPT -s $SUBNET_PRIVATE -o $IF_TUN_0
/sbin/iptables -A FORWARD -i $IF_TUN_0 -o $IF_ETH_0 -j ACCEPT
/sbin/iptables -A FORWARD -i $IF_ETH_0 -o $IF_TUN_0 -j ACCEPT
I have tried entries in csf.allow.
#allow dnsmasq to serve dynamic IPs to virtual machines on local subnet
tcp:in:d=53:s=10.x.y.0/24
udp:in:d=53:s=10.x.y.0/24
tcp:out:d=53:s=10.x.y.0/24
udp:out:d=53:s=10.x.y.0/24
What essential step(s) have I overlooked?