I am working on a thesis research project, and I am having some difficulty figuring out how to get iptables (running on the KVM host) to block traffic (or rather, manipulate traffic) destined for a BRIDGED KVM guest. I am unable to get the iptables entries (pasted below) to block traffic to and from the VM's.

Effectively, I would like my host system to act as a firewall for those guest VM's, and for the time being, I would like to test this capability by simply dropping all packets that is destined for a specific VM. In the not-so-distant future, I would also like to implement more granular controls, and even have a proxy involved. Again, this should happen entirely at the HOST level, and not at the GUEST level.

I am running CentOS 6, and based on another question that I wrote: Use one NIC to create multiple interfaces for Linux KVM, I have the following interfaces configured:


Below is my network setup scripts for each interface:

eth0's Configuation:

NAME="System eth0"

br0's Configuration:


tap0's Configuration:


I have a CentOS 6 VM running and it is configured to utilize the tap0 bridged interface. Networking on the VM is working properly. No other changes to the host system were made.

Below are the non-functioning iptables rules that I added to the FORWARD chain (it is worth noting that I am not a huge expert on iptables yet).

sudo iptables -I FORWARD -i any -o tap0 -j DROP
sudo iptables -I FORWARD -i tap0 -o any -j DROP

After running the commands, the FORWARD table looks like this:

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  tap0   any     anywhere             anywhere            
    0     0 DROP       all  --  any    tap0    anywhere             anywhere            
    0     0 REJECT     all  --  any    any     anywhere             anywhere            reject-with icmp-host-prohibited 

Unfortunately, this does not block the traffic. I don't understand why this would not work.

UPDATE: 11/25/2014: It's been a while since I last updated this. As it turns out, iptables has the physdev plugin, which is actually what I successfully use in my research and is more flexible then ebtables.


Make sure you understand the networking basics involved here. A bridge is a switch and operates at Layer 2. Your iptables rules apply to Layer 3 and will not be passed at this level.

Look into ebtables and specify Layer 2 rules there - or - disable the use of bridges altogether and move to a routed setup in which all traffic is passed through the host at Layer 3. Not sure if the latter option is possible using Libvirt/KVM.

  • Thank you for commenting. How would using ebtables compare to using PHYSDEV as an option in iptables? – Phanto Dec 12 '12 at 1:11
  • Additionally, because this is operating at level 2, how would one perform proxy filtering for that VM? – Phanto Dec 12 '12 at 1:25
  • ebtables looks like the solution for my initial problem, and is thus the answer to this question. – Phanto Dec 16 '12 at 1:19
  • Just to provide an update: physdev in iptables provides much of the functionality that I require, as you can examine the inbound and outbound to an interface on a bridge. – Phanto Nov 25 '14 at 23:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.