0

Issue：

Both the Host machine and VM built with CentOS 6.10. The ExternalMachine⇔VM is routed by using the nat function of Host iptables. As a problem, iptables have started("service iptables status") after restarting the Host machine or turning on the power, but it is not possible for us to route to the VM that has been automatically started. After this phenomenon, restarting iptables("service iptables restart") passes all routing.

Both iptables and VM are running and iptables settings are as expected.

I have no idea why its not possible to route to the VM. I would be grateful If you could teach me what is the problem.

---------AutostartSetting/StopSetting------------

# vi /etc/sysconfig/libvirt-guests
START_DELAY=30
ON_SHUTDOWN=shutdown
SHUTDOWN_TIMEOUT=180

# virsh autostart <VM NAME>

-----OS-------

cat /etc/redhat-release
CentOS release 6.10 (Final)

----kvm----

qemu-kvm-0.12.1.2-2.506.el6_10.5.x86_64

additional info:

---------------
#virsh net-edit default

<network>
  <name>default</name>
  <uuid>1d4f2476-0da2-45d5-b97f-xxxxxxxxxxx</uuid>
  <forward mode='nat'/>
  <bridge name='virbr0' stp='off' delay='0' />
  <mac address='XX:XX:XX:XX:XX:XX'/>
  <ip address='1.2.3.4' netmask='255.255.255.0'>
  </ip>
</network>
-----------------

After confirming it, the startup order of Host daemons are as below.

1.iptables 2.network 3.qemu-ga 4.libvirtd 5.libvirt-guest

libvirt depends on network and network depends on iptables The order of chkconfig could not be changed. In this case, should I have the iptables restart script run at the end of chkconfig, or have anacron restart iptables? or Do you have any other way to archieve it?

lulu_39
  • 43
  • 8

1 Answers1

0

How is the libvirt/qemu network configured? If it is tap networking (or macvtap, same for this matter), then the actual tap device (from ip addr output) only exists while the VM is paused or running. And iptables rules use interfaces so if the interface did not exist when iptables (re)started, then something needs to re-add the rule(s) when the VM is cteated. Simple iptables restart would do too.

aik
  • 1
  • 1
  • Thankyou for your reply. I have the network configuration as [additional info]. Do you need any other information? A virtual bridge(virbr0) is creating an internal private network. – lulu_39 Dec 25 '19 at 04:01