0

Hiho!

I'm using libvirt with kvm and that works great. My desire is to lock down the host system using a host firewall. Up to today I always used shorewall as my iptables mangement utility of choice. But this conflicts with libvirt's iptables management. I used libvirt to configure NAT for kvm guests. Libvirt sets up MASQ for that using iptables which works fine. But as soon as shorewall starts, it flushes the iptables and sets them up according to the configuration made in the shorewall files. What I then tried is to "translate" all libvirt iptables rules into shorewall to prevent losing functionality. But this works only partly and is an ugly hack anyway. As soon as I change the network config with libvirt for a guest, I have to make changes to shorewall as well. So what would be the proper way to both secure the host system as well as using libvirt to manage the network of the kvm guests? Is libvirt coupled with firewalld in the CentOS world? cheerio!

Improve this question
6
  • Do you have to use NAT? Why not switch to using a bridge instead? Then you'll be able to manage iptables on the host in whatever way you want, without messing with libvirt's ruleset
    – dyasny
    Jan 22, 2015 at 21:15
  • Bridging means I have to expose the VMs to the internet in my case. I would like to prevent that for multiple reasons. One is security and another one is that I would like to route traffic from one VM to another before it reaches its destination service (reverse proxying). As far as I understand, your solution would be to firewall inside the guests and the bridge the VM to the internet. This makes the firewall rules management also more inefficient (multiple fw rule sets to manage instead of one on the host).
    – rand0m
    Jan 24, 2015 at 19:34
  • How about a separate firewall VM, bridged to the outside world, and with a second NIC on NAT. The protected VMs also on NAT. The additional VM will be acting as a firewall and router, will provide the extra protection and will be a central configuration point. This way, you can leave the host at defaults, and manage security in a semi-stateful VM (you get the extra advantage of easy VM rollbacks with snapshots etc)
    – dyasny
    Jan 24, 2015 at 20:34
  • Hi dyasny yeah I think that is indeed the best solution. Thanks for your input. But regardless of this solution I cannot imagine that I am the only one having this kind of trouble with libvirt. Let's run this question for a couple of days longer and see if there will be additional input.
    – rand0m
    Jan 25, 2015 at 20:06
  • That's up to you. Generally speaking, libvirt's NAT functionality isn't very widely used. Bridging is the standard, and for more complex stuff there are multiple passthrough and abstraction technologies
    – dyasny
    Jan 26, 2015 at 2:37

1 Answer 1

Reset to default
0

Maybe you can use libvirt's hook script. You script a shell script that libvirt will execute as soon as your VM is started.

Create the file /etc/libvirt/hooks/qemu with this inside:

    #!/bin/bash
    if [ "${1}" = "<the name of your vm>" ] ; then
      VM_NAME=${1}
      VM_IP=172.16.20.10
      if [ "${2}" = "prepare" ] ; then
        iptables -t nat -I POSTROUTING -s ${VM_IP} -o eth0 \
            -m comment --comment "${VM_NAME} nat" -j MASQUERADE
      elif [ "%{2}" = release" ] ; then
        iptables -t nat -D POSTROUTING -s ${VM_IP} -o eth0 \
            -m comment --comment "${VM_NAME} nat" -j MASQUERADE
    fi

Make sure you substitute the <the name of yout vm> and the value of VM_IP appropriately. Make the file executable too: chmod +x /etc/libvirt/hooks/qemu.

Now, every time libvirt start your VM, it will prepare the NAT configuration and after VM stop, will deconfigure the NAT.

For more information, you can look at here and here

Improve this answer
1
  • That is a good proposal and would most certrainly work. The disadvantage is that it does not allow to work with a fw management tool like shorewall. But it allows better customisation and firewalling. Thanks for the input!
    – rand0m
    Jan 29, 2015 at 21:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .