0

Virtual machines (KVM/libvirt) fail to obtain a dynamic IP address from the libvirt-launched dnsmasq running on a CentOS host when the firewall is running. When I turn off the firewall (CSF), the virtual machine obtains an IP. For those who have encountered similar, what worked for you?

I have tried custom iptables rules (INPUT OUTPUT and FORWARD) in csfpost.sh.

/sbin/iptables -A INPUT  -j ACCEPT -s $SUBNET_PRIVATE -i $IF_TUN_0  
/sbin/iptables -A OUTPUT -j ACCEPT -s $SUBNET_PRIVATE -o $IF_TUN_0  
/sbin/iptables -A FORWARD -i $IF_TUN_0 -o $IF_ETH_0 -j ACCEPT  
/sbin/iptables -A FORWARD -i $IF_ETH_0 -o $IF_TUN_0 -j ACCEPT 

I have tried entries in csf.allow.

#allow dnsmasq to serve dynamic IPs to virtual machines on local subnet 
tcp:in:d=53:s=10.x.y.0/24 
udp:in:d=53:s=10.x.y.0/24 
tcp:out:d=53:s=10.x.y.0/24 
udp:out:d=53:s=10.x.y.0/24

What essential step(s) have I overlooked?

1
  • Configuration of UDP port ranges used by dnsmasq are missing in the origninal post.
    – composer
    Dec 3, 2009 at 23:37

1 Answer 1

2

After determining how to open up everything...

/sbin/iptables -A INPUT  -j ACCEPT -p all -s 0/0 -i $IF_TUN_0
/sbin/iptables -A OUTPUT -j ACCEPT -p all -s 0/0 -o $IF_TUN_0

The clue came from /var/log/messages. Ports 67 and 68 were blocked.

# allow broadcasted dhcp requests, IP is unknown hence all zero'd
/sbin/iptables -A INPUT  -j ACCEPT -p udp -d 0/0 -i $IF_TUN_0 --dport 67 --sport 68
# allow dhcp renewal requests, the IP is known at this point
/sbin/iptables -A INPUT  -j ACCEPT -p udp -d $IP_PRIVATE_HOST -i $IF_TUN_0 --dport 68 --sport 67

# allow dhcp acks
/sbin/iptables -A OUTPUT  -j ACCEPT -p udp -s $IP_PRIVATE_HOST -o $IF_TUN_0 --dport 68 --sport 67
# allow dhcp renewal response
/sbin/iptables -A OUTPUT  -j ACCEPT -p udp -s $IP_PRIVATE_HOST -o $IF_TUN_0 --dport 67 --sport 68

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .