[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [libvirt] iptables and libvirt



Ulrich Dangel wrote:
On Friday 13 February 2009 19:21:10 Thomas Woerner wrote:
Hi,

i just got the same idea, so here are some thoughts.

Some Questions:
3) What do you want to do with user-customized firewalls?

I want do to port forwarding for a nat network for statically configured ip addressed.
A solution could be:
<network>
  <name>sample</name>
  <forward dev='eth0' mode='nat'/>
  <bridge name='intbr0' stp='on' forwardDelay='0' />
  <ip address='192.168.122.1' netmask='255.255.255.0'>
    <dhcp>
      <range start='192.168.122.2' end='192.168.122.254' />
      <host mac='AA:BB:CC:DD:EE:FF' ip='192.168.122.102'>
			<port	proto='tcp' destip='EXT_IP' dport='80' />
          <port proto='tcp' destip='EXT_IP' dport='2202' mapped_port='22'>
	  </host>
    </dhcp>
  </ip>
</network>

The first mapping could be translatet in something like
iptables -A FORWARD -i intbr0 -p tcp -d 192.168.122.102 --dport 80 \
-m state NEW -j ACCEPT iptables -t nat -A PREROUTING -p tcp -s EXT_IP --dport 80 -j DNAT \
         --to-destination 192.168.122.102

second one would be

iptables -A FORWARD -i intbr0 -p tcp -d 192.168.122.102 --dport 22 \
-m state NEW -j ACCEPT iptables -t nat -A PREROUTING -p tcp -s EXT_IP --dport 2202 -j DNAT \
         --to-destination 192.168.122.102:22

Hope this makes it a little bit clearer what i want to do with user customized firewalls.

What is EXT_IP here?

These forward rules are exactly what "lokkit --forward-port=if=<interface>:port=<port>:proto=<protocol>[:toport=<destination port>][:toaddr=<destination address>]" already is doing. The configuration is written to /etc/sysconfig/system-config-firewall and
/etc/sysconfig/iptables.

Uli

Thomas


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]