0

I have a KVM running on Ubuntu 14.04 with a few guests (mostly CentOS7) behind NAT configuration.

It seems the guests can't reach the internet connection if the following firewall rules are activated in the host server :

iptables -F
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --source 127.0.0.1 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p all -j DROP
iptables -A OUTPUT -j ACCEPT iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -i virbr0 -j ACCEPT iptables -A INPUT -i virbr1 -j ACCEPT

The last four lines are part of my attempts I have been trying.. no luck!!

If the firewall is disabled, everything works fine. Can you please advice what rules/configuration should I include into my script?

1 Answer 1

1

after several attempts on my own I found the solution to fix the issue just by adding the following rule into my script :

iptables -A INPUT -i virbr1 -j ACCEPT

notice : virbr1 is my local KVM nat network used by the VMs.

so, the script now looks like below :

iptables -F
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --source 127.0.0.1 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i virbr1 -j ACCEPT
iptables -A INPUT -p all -j DROP

very important to have the DROP rule as last line .. this is my understanding so far, but someone here may want to give us more details ..

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .