[PATCH] VirtUtils: bridge initialization adds iptables rules

Jiri Pirko jpirko at redhat.com
Fri May 31 11:34:17 UTC 2013


Mon, May 27, 2013 at 03:53:23PM CEST, olichtne at redhat.com wrote:
>From: Ondrej Lichtner <olichtne at redhat.com>
>
>When creating virtual networks we are using bridge interfaces on the
>host machine. The default behaviour of these bridges is to filter
>packets through iptables, which resulted in IPv6 communication being
>blocked. This commit fixes that by adding iptable calls to the bridge
>initialization. Every newly created bridge now works as an isolated
>network.
>
>From what I've seen these are the same rules added by libvirt when
>creating an isolated network.
>
>Signed-off-by: Ondrej Lichtner <olichtne at redhat.com>
>---
> lnst/Common/VirtUtils.py | 28 ++++++++++++++++++++++++++++
> 1 file changed, 28 insertions(+)
>
>diff --git a/lnst/Common/VirtUtils.py b/lnst/Common/VirtUtils.py
>index 71659ef..e13bfe2 100644
>--- a/lnst/Common/VirtUtils.py
>+++ b/lnst/Common/VirtUtils.py
>@@ -36,6 +36,18 @@ def _brctl(cmd):
>     except ExecCmdFail as err:
>         raise VirtUtilsError("brctl error: %s" % err)
> 
>+def _iptables(cmd):
>+    try:
>+        exec_cmd("iptables %s" % cmd)
>+    except ExecCmdFail as err:
>+        raise VirtUtilsError("iptables error: %s" % err)
>+
>+def _ip6tables(cmd):
>+    try:
>+        exec_cmd("ip6tables %s" % cmd)
>+    except ExecCmdFail as err:
>+        raise VirtUtilsError("ip6tables error: %s" % err)
>+
> def _virsh(cmd):
>     try:
>         exec_cmd("virsh %s" % cmd, log_outputs=False)
>@@ -233,6 +245,14 @@ class BridgeCtl(NetCtl):
>     def init(self):
>         if not self._exists():
>             _brctl("addbr %s" % self._name)
>+            _iptables("-I FORWARD 1 -j REJECT -i %s -o any" % self._name)
>+            _iptables("-I FORWARD 1 -j REJECT -i any -o %s" % self._name)
>+            _iptables("-I FORWARD 1 -j ACCEPT -i %s -o %s" %
>+                                                    (self._name, self._name))
>+            _ip6tables("-I FORWARD 1 -j REJECT -i %s -o any" % self._name)
>+            _ip6tables("-I FORWARD 1 -j REJECT -i any -o %s" % self._name)
>+            _ip6tables("-I FORWARD 1 -j ACCEPT -i %s -o %s" %
>+                                                    (self._name, self._name))
>             self._remove = True
> 
>         _ip("link set %s up" % self._name)
>@@ -241,3 +261,11 @@ class BridgeCtl(NetCtl):
>         if self._remove:
>             _ip("link set %s down" % self._name)
>             _brctl("delbr %s" % self._name)
>+            _iptables("-D FORWARD -j REJECT -i %s -o any" % self._name)
>+            _iptables("-D FORWARD -j REJECT -i any -o %s" % self._name)
>+            _iptables("-D FORWARD -j ACCEPT -i %s -o %s" %
>+                                                    (self._name, self._name))
>+            _ip6tables("-D FORWARD -j REJECT -i %s -o any" % self._name)
>+            _ip6tables("-D FORWARD -j REJECT -i any -o %s" % self._name)
>+            _ip6tables("-D FORWARD -j ACCEPT -i %s -o %s" %
>+                                                    (self._name, self._name))
>-- 
>1.8.1.4
>
>_______________________________________________
>LNST-developers mailing list
>LNST-developers at lists.fedorahosted.org
>https://lists.fedorahosted.org/mailman/listinfo/lnst-developers


applied


More information about the LNST-developers mailing list