Use hooks to restore your iptables rules:
# The "hooks/" folder is not created by default by Libvirt
mkdir /etc/libvirt/hooks
# Libvirt supports multiple possible listeners like "daemon", "qemu", etc.
# We are generating automatically all of these listeners in one go.
for f in daemon qemu lxc libxl network; do
echo '#!/bin/sh
iptables-restore < /etc/sysconfig/iptables' > "/etc/libvirt/hooks/$f"
chmod +x "/etc/libvirt/hooks/$f"
done
# Restarting Libvirt to confirm that rules are actually restored
service libvirtd restart
Iptables rules will be reloaded for certain actions only, but this is sufficient to make it static. Only reload (SIGHUP
) of libvirtd will write it's own rules, but it isn't triggered by any system scripts, so will not happen until you type by yourself:
service libvirtd reload
See https://libvirt.org/hooks.html
UPDATE:
Recent libvirt versions use its own chains to insert rules and these chains are required to start/stop networks and domains. So the previous way won't work. Here are these chains in iptables-restore
format:
*mangle
:LIBVIRT_PRT - [0:0]
-A POSTROUTING -j LIBVIRT_PRT
*filter
:LIBVIRT_FWI - [0:0]
:LIBVIRT_FWO - [0:0]
:LIBVIRT_FWX - [0:0]
:LIBVIRT_INP - [0:0]
:LIBVIRT_OUT - [0:0]
-A INPUT -j LIBVIRT_INP
-A FORWARD -j LIBVIRT_FWX
-A FORWARD -j LIBVIRT_FWI
-A FORWARD -j LIBVIRT_FWO
-A OUTPUT -j LIBVIRT_OUT
*nat
:LIBVIRT_PRT - [0:0]
-A POSTROUTING -j LIBVIRT_PRT
To override libvirtd rules just put your custom rules before the libvirt-jump rule (-j LIBVIRT_XXX). When libvirtd/network/domain starts it only inserts jump-rules if they don't exist. So all you need is load your rules (with all libvirt chains created and libvirt-jump rules correctly placed) before libvirtd starts. From another point of view - you need to restart/reload libvirtd every time after changing and loading your new rules - to let it insert libvirt's ones.