Hey,
So, the latest patches are at:
http://www.gnome.org/~markmc/code/libvirt-networking/
I'm pretty happy with how things are at the moment. I've more or less
cleared out my todo list on this[1], but I'm left with a big fat
elephant sitting in the corner looking quite guilty ... iptables :-)
Basically, once you create a virtual network, you need the following
iptables rules:
- Allow bridging across the vnet's bridge - e.g. just allow all
bridging:
$> iptables -D FORWARD 1
$> iptables -A FORWARD -m physdev ! --physdev-is-bridged
-j REJECT --reject-with icmp-host-prohibited
- Allow DHCP and DNS requests from guests:
$> iptables -I INPUT -p tcp -m tcp --dport 53 -j ACCEPT
$> iptables -I INPUT -p udp -m udp --dport 53 -j ACCEPT
$> iptables -I INPUT -p udp -m udp --dport 67 -j ACCEPT
- Enable forwarding and SNAT:
$> echo 1 > /proc/sys/net/ipv4/ip_forward
$> iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
- And any DNAT rules to e.g. re-direct port 8080 on the host to port
80 on a specific guest.
Figuring out what the rules should be and adding them isn't a
problem ... the problem is how to interact with the underlying
distributions iptables infrastructure.
e.g. in Fedora, if you just go ahead and add these rules, they'd be
wiped out by "service iptables restart", or overwritten by the firewall
config tool or saved and applied at boot if you used "service iptables
save". Bit of a mess :/
Cheers,
Mark.
[1] - Well, networks for unprivileged users is another big todo item
--
Libvir-list mailing list
Libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list
