F-11 libvirt no longer creating firewall/iptables rules for virtual network?

[Jonathan Underwood]

Hi there,

I've recently installed F-11 and am having a problem with networking
between the host and guest with the default network configuration -
specifically that the iptables rules for virbr0 are not being inserted
by libvirt as they used to be under F-10.

I am using the default configuration of the firewall as shipped with
F-11. The guest instance is a windowsXP image created under F-10 - I
simply recreated the cconfig files by "creating" a new guest under
virt-manager and pointing it to the disk image file. The guest boots
up fine, but no networking. The output of iptables -L doesn't contain
any reference to virbr0 or vnet0 (the latter automatically created
when starting the guest OS) - I have confirmed virbr0 and vnet0 are
present using ifconfig.. In case it's relevant this machine is using
NetworkManager and has a single wired ethernet adapter configured with
a static IP.

Any suggestions on how I can debug further ?

Thanks,
jonathan

[Dale Bewley]

On Thu, 2009-06-25 at 19:43 +0100, Jonathan Underwood wrote:
> Hi there,
>
> I've recently installed F-11 and am having a problem with networking
> between the host and guest with the default network configuration -
> specifically that the iptables rules for virbr0 are not being inserted
> by libvirt as they used to be under F-10.
>
> I am using the default configuration of the firewall as shipped with
> F-11. The guest instance is a windowsXP image created under F-10 - I
> simply recreated the cconfig files by "creating" a new guest under
> virt-manager and pointing it to the disk image file. The guest boots
> up fine, but no networking. The output of iptables -L doesn't contain
> any reference to virbr0 or vnet0 (the latter automatically created
> when starting the guest OS) - I have confirmed virbr0 and vnet0 are
> present using ifconfig.. In case it's relevant this machine is using
> NetworkManager and has a single wired ethernet adapter configured with
> a static IP.
>
> Any suggestions on how I can debug further ?

# iptables --line-numbers -L -v -n

# chkconfig libvirtd --list

# virsh net-list --all
Name                 State      Autostart
-----------------------------------------
default              active     yes

# virsh net-destroy default

# virsh net-start default

# virsh help |grep net
    attach-interface attach network interface
    detach-interface detach network interface
    domifstat       get network interface stats for a domain
    net-autostart   autostart a network
    net-create      create a network from an XML file
    net-define      define (but don't start) a network from an XML file
    net-destroy     destroy a network
    net-dumpxml     network information in XML
    net-edit        edit XML configuration for a network
    net-list        list networks
    net-name        convert a network UUID to network name
    net-start       start a (previously defined) inactive network
    net-undefine    undefine an inactive network
    net-uuid        convert a network name to network UUID

The rules that should be inserted are found
in /var/lib/libvirt/iptables.

[Mark McLoughlin]

Hi Jonathan,

On Thu, 2009-06-25 at 19:43 +0100, Jonathan Underwood wrote:
> Hi there,
>
> I've recently installed F-11 and am having a problem with networking
> between the host and guest with the default network configuration -
> specifically that the iptables rules for virbr0 are not being inserted
> by libvirt as they used to be under F-10.
>
> I am using the default configuration of the firewall as shipped with
> F-11. The guest instance is a windowsXP image created under F-10 - I
> simply recreated the cconfig files by "creating" a new guest under
> virt-manager and pointing it to the disk image file. The guest boots
> up fine, but no networking. The output of iptables -L doesn't contain
> any reference to virbr0 or vnet0 (the latter automatically created
> when starting the guest OS) - I have confirmed virbr0 and vnet0 are
> present using ifconfig.. In case it's relevant this machine is using
> NetworkManager and has a single wired ethernet adapter configured with
> a static IP.
>
> Any suggestions on how I can debug further ?

Did you figure out what the issue here was?

Thanks,
Mark.

[Jonathan Underwood]

Hi Mark,

2009/7/3 Mark McLoughlin :
> Did you figure out what the issue here was?

I am afraid I didn't get to the bottom of the problem because updated
packages for F-11 libvirt appeared which I installed, and they fixed
the problem. My observation was that with previous packages that a
"service libvirtd [reload|restart]" wasn't recreating the needed
iptables rules though. If it's useful I could dig deeper and try
reinstalling the old packages and try to recreate the problem, but I'm
not sure it's worth the trouble.

J.