1

At first, I want to say: I know, it was done initially wrong and I want to avoid doing everything again from the scratch because of general downtime.

I am running libvirt/KVM on RHEL. I've got VM which runs with NAT networking profile (default one). I've set up port forwarding etc from host via sysconfig/iptables, everything is fine.

But if libvird daemon reloads for some internal reason, or receives SIGHUP - it reloads iptables configuration and adds rules from it's filtering profiles i.e. everything works as designed and documented (libvirt and firewall + libvirt nwfilter documentation) - there is no problem with SW, this is configuration issue.

But some rules introduce REJECTs before i need it and I can't connect to the machine via forwarded ports as seen below:

enter image description here

after running service iptables restart - everything will work as before.

Is there a way to force libvirt to change order of these two or disable these particular ones?

Maybe someone faced exactly the same issue and has answer ready.

Thanks

  • I use firewalld on my current systems. It plays much more nicely with libvirt. – Michael Hampton Dec 28 '15 at 11:53
1

You can create your own NAT network instead which means libvirt won't add any firewall rules. See the Custom NAT-based Network on this libvirt Networking Handbook.

  • Looks like this is only workaround available :) – GioMac Dec 28 '15 at 9:47
3

I feel your pain. I really wish libvirt supported this better.

Create a script that applies the port forwarding firewall rules on your guest. Be sure to use iptables -I so that your rules are inserted before libvirt's REJECT rule.

You need to use hooks to run that script each time libvirt starts or is reloaded.

Also, you should make sure that the rules for libvirt and your port forwarding aren't saved in /etc/sysconfig/iptables. Let libvirt and your hook set those up.

  • yup, a known issue with libvirt, which is why I always recommend sticking to bridging – dyasny Jan 9 '14 at 4:08
  • aha, so far only bridging is a good solution – GioMac Jan 10 '14 at 12:33

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.