Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #234903

Re: Shorewall and libvirt

Show all headers | View raw

On 5/6/2021 5:03 AM, Charles Curley wrote:
> For years, up through Buster, I have had a nice setup with virtual
> machines on my laptops, with firewalling provided by shorewall and
> rules I have added over the years. As I move from network to network,
> the firewall is reconfigured, and the VMs continue to work. I also have
> scripts that detect my home networks, and re-do the firewall for use on
> the home network.
>
> Now, with Bullseye, I seem to be hitting a brick wall. Something --
> libvirt?? -- is mucking with my firewalling and breaking the virtual
> internal networking.
>
> What is the preferred way of running libvirt on a laptop? I do not
> *have* to have shorewall, but would like some sort of firewall tool.
>

First you need to disable libvirt from playing with iptables, I changed
(virsh net-edit default) from:
   <forward mode='nat'/>

to:

   <forward mode='open'/>

Then you can use whatever firewalling solution you like (this is
documented in Libvirt's doc).


Remember that Bullseye as nftables per default, you might want to switch
back to iptables for Shorewall to work properly.

--
John Doe

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Shorewall and libvirt Charles Curley <charlescurley@charlescurley.com> - 2021-05-06 05:10 +0200
  Re: Shorewall and libvirt john doe <johndoe65534@mail.com> - 2021-05-06 09:50 +0200
    Re: Shorewall and libvirt Charles Curley <charlescurley@charlescurley.com> - 2021-05-06 21:10 +0200
      Re: Shorewall and libvirt john doe <johndoe65534@mail.com> - 2021-05-06 21:30 +0200
        Re: Shorewall and libvirt Charles Curley <charlescurley@charlescurley.com> - 2021-05-07 01:50 +0200
          Re: Shorewall and libvirt Andrei POPESCU <andreimpopescu@gmail.com> - 2021-05-07 08:20 +0200

csiph-web