0

I'm running centos 7, lxc for containers, virsh for setting up a bridge.

Upon creation, virsh set up some firewall rules for virbr

# iptables-save | grep virbr
-A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
-A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
-A FORWARD -d 192.168.122.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
-A FORWARD -i virbr0 -o virbr0 -j ACCEPT
-A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -o virbr0 -p udp -m udp --dport 68 -j ACCEPT

I've read all I could google but I could not find a correct way to enable, say, icmp, ssh and http.

I can easily done it manually (and repeat after each reboot), I can even patch it somewhere into some random script file; but is there any way to properly control nwfilters? I can list them, edit, dump... but can't USE!

Alex Povolotsky
  • 101
  • 1
    I apologize; I misread your question. If you're *only* using virsh to set up the bridge, you can't use libvirt network filters -- they apply to individual virtual machines, so if you're not starting vms, they're of no use. I would suggest using the standard network configuration scripts for setting up the bridge instead of libvirt (`/etc/sysconfig/network-scripts`). You can create persistent firewall rules byinstalling `iptables-services` and editing `/etc/sysconfig/iptables`, but these are global, not per-container. – larsks Jan 28 '23 at 13:48
  • 1
    For most container runtimes (e.g., docker, podman), per-container service access is managed via port-forwarding. I'm not sure if LXC has a similar facility. – larsks Jan 28 '23 at 13:49
  • That's becoming more clear. I should either use virsh for BOTH network and container setup, or resort to global solution. Well then: where does virsh get its default rules? I'd just patch them for now. – Alex Povolotsky Jan 29 '23 at 18:01

0 Answers0