Virtual machines (KVM/libvirt) fail to obtain a dynamic IP address from the libvirt-launched dnsmasq running on a CentOS host when the firewall is running. When I turn off the firewall (CSF), the virtual machine obtains an IP. For those who have encountered similar, what worked for you?

I have tried custom iptables rules (INPUT OUTPUT and FORWARD) in csfpost.sh.

/sbin/iptables -A INPUT  -j ACCEPT -s $SUBNET_PRIVATE -i $IF_TUN_0  
/sbin/iptables -A OUTPUT -j ACCEPT -s $SUBNET_PRIVATE -o $IF_TUN_0  
/sbin/iptables -A FORWARD -i $IF_TUN_0 -o $IF_ETH_0 -j ACCEPT  
/sbin/iptables -A FORWARD -i $IF_ETH_0 -o $IF_TUN_0 -j ACCEPT 

I have tried entries in csf.allow.

#allow dnsmasq to serve dynamic IPs to virtual machines on local subnet 

What essential step(s) have I overlooked?

  • Configuration of UDP port ranges used by dnsmasq are missing in the origninal post.
    – composer
    Dec 3, 2009 at 23:37

1 Answer 1


After determining how to open up everything...

/sbin/iptables -A INPUT  -j ACCEPT -p all -s 0/0 -i $IF_TUN_0
/sbin/iptables -A OUTPUT -j ACCEPT -p all -s 0/0 -o $IF_TUN_0

The clue came from /var/log/messages. Ports 67 and 68 were blocked.

# allow broadcasted dhcp requests, IP is unknown hence all zero'd
/sbin/iptables -A INPUT  -j ACCEPT -p udp -d 0/0 -i $IF_TUN_0 --dport 67 --sport 68
# allow dhcp renewal requests, the IP is known at this point
/sbin/iptables -A INPUT  -j ACCEPT -p udp -d $IP_PRIVATE_HOST -i $IF_TUN_0 --dport 68 --sport 67

# allow dhcp acks
/sbin/iptables -A OUTPUT  -j ACCEPT -p udp -s $IP_PRIVATE_HOST -o $IF_TUN_0 --dport 68 --sport 67
# allow dhcp renewal response
/sbin/iptables -A OUTPUT  -j ACCEPT -p udp -s $IP_PRIVATE_HOST -o $IF_TUN_0 --dport 67 --sport 68

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.