Re: Firewalld + libvirt rules conflict

--000000000000e9aad705d439220d
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Put the rule in a network hook script (https://www.libvirt.org/hooks.html)

Le mar. 28 d=C3=A9c. 2021 =C3=A0 14:49, Nick <[email protected]> a =C3=A9cr=
it :

> Using KVM/libvirt in NAT mode to run VM guests needs forwarding to be
> enabled in order to redirect host port to vm port. Libvirt add iptables
> rules to do it's magic in addition I had to add some more rules like:
>
> iptables -I FORWARD -o virbr0 --proto tcp -m conntrack --ctstate NEW -j
> ACCEPT
>
> or
>
> firewall-cmd --permanent --direct --passthrough ipv4 -I FORWARD -o
> virbr0 -j ACCEPT
>
>
> This works on the fly but not when firewalld is reload because the rule
> goes at the bottom of the FORWARD chain where it's supposed to be at the
> top.
>
>
> This works
>
> Chain FORWARD (policy ACCEPT)
> target     prot opt source               destination
> ACCEPT     all  --  anywhere             anywhere
> LIBVIRT_FWX  all  --  anywhere             anywhere
> LIBVIRT_FWI  all  --  anywhere             anywhere
> LIBVIRT_FWO  all  --  anywhere             anywhere
>
>
> This doesn't work
>
> Chain FORWARD (policy ACCEPT)
> target     prot opt source               destination
> LIBVIRT_FWX  all  --  anywhere             anywhere
> LIBVIRT_FWI  all  --  anywhere             anywhere
> LIBVIRT_FWO  all  --  anywhere             anywhere
> ACCEPT     all  --  anywhere             anywhere
>
>
> As it seems there is no way to insert the needed rule at the top even
> with -I FORWARD 1 upon firewall-cmd --reload, so what options there are
> left to avoid additional work every time firewalld is reloaded?
>
>
> There are a number of articles on the topic (qemu hook hack etc) but non
> of them seems to provide a working solution for this case.
>
>
> Please advice.
>
>

--000000000000e9aad705d439220d
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Put the rule in a network hook script (<a href=3D"https://=
www.libvirt.org/hooks.html">https://www.libvirt.org/hooks.html</a>)</div><b=
r><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">Le=C2=A0=
mar. 28 d=C3=A9c. 2021 =C3=A0=C2=A014:49, Nick &lt;<a href=3D"mailto:decrof=
[email protected]">[email protected]</a>&gt; a =C3=A9crit=C2=A0:<br></div><blockq=
uote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1p=
x solid rgb(204,204,204);padding-left:1ex">Using KVM/libvirt in NAT mode to=
 run VM guests needs forwarding to be <br>
enabled in order to redirect host port to vm port. Libvirt add iptables <br=
>
rules to do it&#39;s magic in addition I had to add some more rules like:<b=
r>
<br>
iptables -I FORWARD -o virbr0 --proto tcp -m conntrack --ctstate NEW -j <br=
>
ACCEPT<br>
<br>
or<br>
<br>
firewall-cmd --permanent --direct --passthrough ipv4 -I FORWARD -o <br>
virbr0 -j ACCEPT<br>
<br>
<br>
This works on the fly but not when firewalld is reload because the rule <br=
>
goes at the bottom of the FORWARD chain where it&#39;s supposed to be at th=
e <br>
top.<br>
<br>
<br>
This works<br>
<br>
Chain FORWARD (policy ACCEPT)<br>
target=C2=A0=C2=A0=C2=A0=C2=A0 prot opt source=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 destination<br>
ACCEPT=C2=A0=C2=A0=C2=A0=C2=A0 all=C2=A0 --=C2=A0 anywhere=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 anywhere<br>
LIBVIRT_FWX=C2=A0 all=C2=A0 --=C2=A0 anywhere=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 anywhere<br>
LIBVIRT_FWI=C2=A0 all=C2=A0 --=C2=A0 anywhere=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 anywhere<br>
LIBVIRT_FWO=C2=A0 all=C2=A0 --=C2=A0 anywhere=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 anywhere<br>
<br>
<br>
This doesn&#39;t work<br>
<br>
Chain FORWARD (policy ACCEPT)<br>
target=C2=A0=C2=A0=C2=A0=C2=A0 prot opt source=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 destination<br>
LIBVIRT_FWX=C2=A0 all=C2=A0 --=C2=A0 anywhere=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 anywhere<br>
LIBVIRT_FWI=C2=A0 all=C2=A0 --=C2=A0 anywhere=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 anywhere<br>
LIBVIRT_FWO=C2=A0 all=C2=A0 --=C2=A0 anywhere=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 anywhere<br>
ACCEPT=C2=A0=C2=A0=C2=A0=C2=A0 all=C2=A0 --=C2=A0 anywhere=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 anywhere<br>
<br>
<br>
As it seems there is no way to insert the needed rule at the top even <br>
with -I FORWARD 1 upon firewall-cmd --reload, so what options there are <br=
>
left to avoid additional work every time firewalld is reloaded?<br>
<br>
<br>
There are a number of articles on the topic (qemu hook hack etc) but non <b=
r>
of them seems to provide a working solution for this case.<br>
<br>
<br>
Please advice.<br>
<br>
</blockquote></div>

--000000000000e9aad705d439220d--