[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [libvirt] libvirt modifying iptables rules



On Sun, Mar 07, 2010 at 07:39:59PM +0530, Varrun Ramani wrote:
> Hi
> 
> I am right now undertaking a project which deals with verification of
> firewall rules. I wish to know which applications/libraries modify/query
> firewall rules. I came to know that libvirt modifies iptables rules. Can
> anyone let me know for what purposes/how libvirt modifies the rules?

The 'virtual network' functionality in libvirt sets up a isolated bridge
device, to which guests are connected. libvirt uses iptables to control
what happens to traffic on that bridge device. Either we stop it leaving
the bridge entirely (only VM<->VM and VM<->host), or allow it to get to
the LAN either routing a subnet, or using NAT to masquerade it. The
rules are written such that they only match traffic relating to the
configured bridge device in libvirt, so they shouldn't expose the rest of
the host interfaces to any new traffic risks

Regards,
Daniel
-- 
|: Red Hat, Engineering, London    -o-   http://people.redhat.com/berrange/ :|
|: http://libvirt.org -o- http://virt-manager.org -o- http://deltacloud.org :|
|: http://autobuild.org        -o-         http://search.cpan.org/~danberr/ :|
|: GnuPG: 7D3B9505  -o-   F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]