On Sun, Nov 17, 2019 at 10:14 AM Ed Greshko ed.greshko@greshko.com wrote:
On 11/17/19 5:07 PM, Tom H wrote:
On Sun, Nov 17, 2019 at 1:49 AM Ed Greshko ed.greshko@greshko.com wrote:
I put the interface virbr0 in the FW zone libvirt.
Wow. Weird that virbr0 is firewalled, but good to know. Thanks.
Yep, and as my other post states I think it always was there. If one reads the description in /usr/lib/firewalld/zones/libvirt.xml they'd see.
<description> The default policy of "ACCEPT" allows all packets to/from interfaces in the zone to be forwarded, while the (*low priority*) reject rule blocks any traffic destined for the host, except those services explicitly listed (that list can be modified as required by the local admin). This zone is intended to be used only by libvirt virtual networks - libvirt will add the bridge devices for all new virtual networks to this zone by default. </description>
Thanks. I assume that you didn't just add virbr0 to the libvirt zone, but that you also added the three nfs-related services to this zone.
Comment from the libvirt source
/* if firewalld is active, try to set the "libvirt" zone. This is * desirable (for consistency) if firewalld is using the iptables * backend, but is necessary (for basic network connectivity) if * firewalld is using the nftables backend */
So it's an nftables requirement.