Using KVM/libvirt in NAT mode to run VM guests needs forwarding to be
enabled in order to redirect host port to vm port. Libvirt add iptables
rules to do it's magic in addition I had to add some more rules like:

iptables -I FORWARD -o virbr0 --proto tcp -m conntrack --ctstate NEW -j
ACCEPT

or

firewall-cmd --permanent --direct --passthrough ipv4 -I FORWARD -o
virbr0 -j ACCEPT


This works on the fly but not when firewalld is reload because the rule
goes at the bottom of the FORWARD chain where it's supposed to be at the
top.


This works

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination ACCEPT     all  --  anywhere             anywhere LIBVIRT_FWX  all  --  anywhere             anywhere LIBVIRT_FWI  all  --  anywhere             anywhere LIBVIRT_FWO  all  --  anywhere             anywhere


This doesn't work

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination LIBVIRT_FWX  all  --  anywhere             anywhere LIBVIRT_FWI  all  --  anywhere             anywhere LIBVIRT_FWO  all  --  anywhere             anywhere ACCEPT     all  --  anywhere             anywhere


As it seems there is no way to insert the needed rule at the top even
with -I FORWARD 1 upon firewall-cmd --reload, so what options there are
left to avoid additional work every time firewalld is reloaded?


There are a number of articles on the topic (qemu hook hack etc) but non
of them seems to provide a working solution for this case.


Please advice.

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Put the rule in a network hook script (https://www.libvirt.org/hooks.html)

Le mar. 28 déc. 2021 à 14:49, Nick <decrofn@gmail.com> a écrit :

Using KVM/libvirt in NAT mode to run VM guests needs forwarding to be
enabled in order to redirect host port to vm port. Libvirt add iptables
rules to do it's magic in addition I had to add some more rules like:

iptables -I FORWARD -o virbr0 --proto tcp -m conntrack --ctstate NEW -j ACCEPT

or

firewall-cmd --permanent --direct --passthrough ipv4 -I FORWARD -o
virbr0 -j ACCEPT

This works on the fly but not when firewalld is reload because the rule
goes at the bottom of the FORWARD chain where it's supposed to be at the
top.

This works

Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
LIBVIRT_FWX all -- anywhere anywhere
LIBVIRT_FWI all -- anywhere anywhere
LIBVIRT_FWO all -- anywhere anywhere

This doesn't work

Chain FORWARD (policy ACCEPT)
target prot opt source destination
LIBVIRT_FWX all -- anywhere anywhere
LIBVIRT_FWI all -- anywhere anywhere
LIBVIRT_FWO all -- anywhere anywhere
ACCEPT all -- anywhere anywhere

As it seems there is no way to insert the needed rule at the top even
with -I FORWARD 1 upon firewall-cmd --reload, so what options there are
left to avoid additional work every time firewalld is reloaded?

There are a number of articles on the topic (qemu hook hack etc) but non
of them seems to provide a working solution for this case.

Please advice.

<div dir="ltr">Put the rule in a network hook script (<a href="https://www.libvirt.org/hooks.html">https://www.libvirt.org/hooks.html</a>)</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Le mar. 28 déc. 2021 à 14:49, Nick &lt;<a
href="mailto:decrofn@gmail.com">decrofn@gmail.com</a>&gt; a écrit :<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Using KVM/libvirt in NAT mode to run VM guests needs
forwarding to be <br>
enabled in order to redirect host port to vm port. Libvirt add iptables <br> rules to do it&#39;s magic in addition I had to add some more rules like:<br>

iptables -I FORWARD -o virbr0 --proto tcp -m conntrack --ctstate NEW -j <br> ACCEPT<br>

or<br>

firewall-cmd --permanent --direct --passthrough ipv4 -I FORWARD -o <br>
virbr0 -j ACCEPT<br>


This works on the fly but not when firewalld is reload because the rule <br> goes at the bottom of the FORWARD chain where it&#39;s supposed to be at the <br>
top.<br>


This works<br>

Chain FORWARD (policy ACCEPT)<br>
target     prot opt source               destination<br> ACCEPT     all  --  anywhere             anywhere<br> LIBVIRT_FWX  all  --  anywhere             anywhere<br> LIBVIRT_FWI  all  --  anywhere             anywhere<br> LIBVIRT_FWO  all  --  anywhere             anywhere<br>


This doesn&#39;t work<br>

Chain FORWARD (policy ACCEPT)<br>
target     prot opt source               destination<br> LIBVIRT_FWX  all  --  anywhere             anywhere<br> LIBVIRT_FWI  all  --  anywhere             anywhere<br> LIBVIRT_FWO  all  --  anywhere             anywhere<br> ACCEPT     all  --  anywhere             anywhere<br>


As it seems there is no way to insert the needed rule at the top even <br>
with -I FORWARD 1 upon firewall-cmd --reload, so what options there are <br> left to avoid additional work every time firewalld is reloaded?<br>


There are a number of articles on the topic (qemu hook hack etc) but non <br> of them seems to provide a working solution for this case.<br>


Please advice.<br>

</blockquote></div>

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

This is a multi-part message in MIME format.
I don't see any difference, hook is not triggered after firewall-cmd
--reload.


Reading the https://www.libvirt.org/hooks.html#location

/etc/libvirt/hooks/network
Executed when a network is started or stopped or an interface is plugged/unplugged to/from the network <-- this doesn't seem to be
exactly what is needed as no such events occur.

At this point systemctl restart libvirtd will trigger /etc/libvirt/hooks/network and insert the desired rules which I think is strange because there is /etc/libvirt/hooks/daemon for this.

--
*This server is power by 220V*

<html>
<head>

<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>I don't see any difference, hook is not triggered after
firewall-cmd --reload.</p>
<p><br>
</p>
<p>Reading the <a class="moz-txt-link-freetext" href="https://www.libvirt.org/hooks.html#location">https://www.libvirt.org/hooks.html#location</a><br>
</p>
<p>/etc/libvirt/hooks/network<br>
Executed when a network is started or stopped or an interface is
plugged/unplugged to/from the network &lt;-- this doesn't seem to
be exactly what is needed as no such events occur.<br>
</p>
<p>At this point systemctl restart libvirtd will trigger
/etc/libvirt/hooks/network and insert the desired rules which I
think is strange because there is /etc/libvirt/hooks/daemon for
this.<br>
</p>
<div class="moz-signature">-- <br>
<b>This server is power by 220V</b></div>
</body>
</html>

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

I don't see any difference, hook is not triggered after firewall-cmd
--reload.


Reading the https://www.libvirt.org/hooks.html#location

/etc/libvirt/hooks/network
Executed when a network is started or stopped or an interface is plugged/unplugged to/from the network <-- this doesn't seem to be
exactly what is needed as no such events occur.

At this point systemctl restart libvirtd will trigger /etc/libvirt/hooks/network and insert the desired rules which I think is strange because there is /etc/libvirt/hooks/daemon for this.

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)