On 11/18/19 4:03 AM, Tom H wrote:
On Sun, Nov 17, 2019 at 10:14 AM Ed Greshko
<ed.greshko(a)greshko.com> wrote:
> On 11/17/19 5:07 PM, Tom H wrote:
>> On Sun, Nov 17, 2019 at 1:49 AM Ed Greshko <ed.greshko(a)greshko.com> wrote:
>>> I put the interface virbr0 in the FW zone libvirt.
>> Wow. Weird that virbr0 is firewalled, but good to know. Thanks.
> Yep, and as my other post states I think it always was there. If
> one reads the description in
> /usr/lib/firewalld/zones/libvirt.xml they'd see.
>
> <description>
> The default policy of "ACCEPT" allows all packets to/from
> interfaces in the zone to be forwarded, while the (*low priority*)
> reject rule blocks any traffic destined for the host, except those
> services explicitly listed (that list can be modified as required
> by the local admin). This zone is intended to be used only by
> libvirt virtual networks - libvirt will add the bridge devices for
> all new virtual networks to this zone by default.
> </description>
Thanks. I assume that you didn't just add virbr0 to the libvirt zone,
but that you also added the three nfs-related services to this zone.
But, of course. I thought I mentioned that I was manipulating the wrong zone due to
being misled by a GUI. Oh, and my ignorance. :-)
And, that on further review, virbr0 was always in the libvirt zone.
Comment from the libvirt source
/* if firewalld is active, try to set the "libvirt" zone. This is
* desirable (for consistency) if firewalld is using the iptables
* backend, but is necessary (for basic network connectivity) if
* firewalld is using the nftables backend
*/
So it's an nftables requirement.
Good to know...
--
The key to getting good answers is to ask good questions.