On my my VM host, I have two libvirt virtual networks:
- virbr0: 192.168.122.1/255.255.255.0
- virbr1: 192.168.130.1/255.255.255.0
I have a VM behind each of those virtual networks. Machines can see the host, and see the Internet. However, when I try to connect from one network to the other, I get "connection refused" even though I am connecting to a port I know is open.
I have disabled UFW (host is Ubuntu) and still fails. Nothing is logged, so I'm not sure which rule is blocking it. My FORWARD block (I assume created by virtlib) is:
Chain FORWARD (policy ACCEPT)
target prot opt source destination
DOCKER all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere 192.168.122.0/24 ctstate RELATED,ESTABLISHED
ACCEPT all -- 192.168.122.0/24 anywhere
ACCEPT all -- anywhere anywhere
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
ACCEPT all -- anywhere 192.168.130.0/24 ctstate RELATED,ESTABLISHED
ACCEPT all -- 192.168.130.0/24 anywhere
ACCEPT all -- anywhere anywhere
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
If I clear all the firewall rules, then the VMs on different virtual networks can talk to each other, but of course they can't talk off the VM hosts.
I found if I got rid of these rules:
-A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -o virbr1 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i virbr1 -j REJECT --reject-with icmp-port-unreachable
The VMs could then talk to each other. That's great, but how do I instruct libvirt to modify how it creates the forward rules so it doesn't prohibit traffic between the virtual networks?
Thanks for any tips, pointers, or URLs!