[fedora-virt] libvirtd and public access to guests

Daniel P. Berrange berrange at redhat.com
Thu Oct 8 20:57:01 UTC 2009


On Thu, Oct 08, 2009 at 01:09:35PM +0200, Pavel Lisy wrote:
> Hello
> 
> I've started playing with libvirt and I have question?
> 
> What is proper way to make guest accessible from net. 

The shared physical device, bridging option is what you want
to use 

http://wiki.libvirt.org/page/Networking#Fedora.2FRHEL_Bridging

> I have mode=nat /var/lib/libvirt/network/default.xml. 

NAT is for outbound internet access only - it doesn't allow
for remote clients to connect to your VM.

> libvirtd makes this rules in FORWARD chain
> 
> -A FORWARD -d 192.168.231.0/24 -o virbr0 -m state --state
> RELATED,ESTABLISHED -j ACCEPT 
> -A FORWARD -s 192.168.231.0/24 -i virbr0 -j ACCEPT 
> -A FORWARD -i virbr0 -o virbr0 -j ACCEPT 
> -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable 
> -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable 
> -A FORWARD -j REJECT --reject-with icmp-host-prohibited 
> 
> If I add 
> iptables -I FORWARD -i eth0 -o virbr0 -j ACCEPT
> guests are accessible
> 
> My question is:
> Is is possible write this somewhere to configuration? 
> 
> I've tried to put it in /etc/sysconfig/iptables but it libvirtd put his
> rules before mine.
> 
> I've found two directories
> /var/lib/libvirt/iptables/filter
> /var/lib/libvirt/iptables/nat
> 
> I suppose I can write my rules here but I haven't find any docs about
> format. Can somebody help me with it?

You shouldn't try to overwrite/override libvirt's rules here, since libvirt
will likely just break your changes at some point. You really want to switch
to a bridged network config, instead of the NAT based one


Daniel
-- 
|: Red Hat, Engineering, London   -o-   http://people.redhat.com/berrange/ :|
|: http://libvirt.org  -o-  http://virt-manager.org  -o-  http://ovirt.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: GnuPG: 7D3B9505  -o-  F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|




More information about the Fedora-virt mailing list