#942368 libvirt-daemon: firewall rules lost when firewalld restarts

Package:
libvirt-daemon
Source:
libvirt
Description:
Virtualization daemon
Submitter:
Sam Morris
Date:
2021-05-24 21:15:46 UTC
Severity:
normal
#942368#5
Date:
2019-10-15 10:27:38 UTC
From:
To:
My virtual machines often lose connectivity to external networks. This
seems to be because libvirt's iptables rules are missing:

    root@fragarach:~# iptables -nv -L FORWARD
    Chain FORWARD (policy DROP 0 packets, 0 bytes)
     pkts bytes target     prot opt in     out     source               destination
	0     0 DOCKER-USER  all  --  *      *       0.0.0.0/0            0.0.0.0/0
	0     0 DOCKER-ISOLATION-STAGE-1  all  --  *      *       0.0.0.0/0            0.0.0.0/0
	0     0 ACCEPT     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
	0     0 DOCKER     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0
	0     0 ACCEPT     all  --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0
	0     0 ACCEPT     all  --  docker0 docker0  0.0.0.0/0            0.0.0.0/0
	0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED,DNAT
	0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
	0     0 FORWARD_direct  all  --  *      *       0.0.0.0/0            0.0.0.0/0
	0     0 FORWARD_IN_ZONES  all  --  *      *       0.0.0.0/0            0.0.0.0/0
	0     0 FORWARD_OUT_ZONES  all  --  *      *       0.0.0.0/0            0.0.0.0/0
	0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID PKTTYPE = unicast LOG flags 0 level 4 prefix "STATE_INVALID_DROP: "
	0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
	0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            PKTTYPE = unicast LOG flags 0 level 4 prefix "FINAL_REJECT: "
	0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

This is fixed by restarting firewalld:

    root@fragarach:~# systemctl restart libvirtd
    root@fragarach:~# iptables -nv -L FORWARD
    Chain FORWARD (policy DROP 0 packets, 0 bytes)
     pkts bytes target     prot opt in     out     source               destination
	0     0 LIBVIRT_FWX  all  --  *      *       0.0.0.0/0            0.0.0.0/0
	0     0 LIBVIRT_FWI  all  --  *      *       0.0.0.0/0            0.0.0.0/0
	0     0 LIBVIRT_FWO  all  --  *      *       0.0.0.0/0            0.0.0.0/0
	0     0 DOCKER-USER  all  --  *      *       0.0.0.0/0            0.0.0.0/0
	0     0 DOCKER-ISOLATION-STAGE-1  all  --  *      *       0.0.0.0/0            0.0.0.0/0
	0     0 ACCEPT     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
	0     0 DOCKER     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0
	0     0 ACCEPT     all  --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0
	0     0 ACCEPT     all  --  docker0 docker0  0.0.0.0/0            0.0.0.0/0
	0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED,DNAT
	0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
	0     0 FORWARD_direct  all  --  *      *       0.0.0.0/0            0.0.0.0/0
	0     0 FORWARD_IN_ZONES  all  --  *      *       0.0.0.0/0            0.0.0.0/0
	0     0 FORWARD_OUT_ZONES  all  --  *      *       0.0.0.0/0            0.0.0.0/0
	0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID PKTTYPE = unicast LOG flags 0 level 4 prefix "STATE_INVALID_DROP: "
	0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
	0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            PKTTYPE = unicast LOG flags 0 level 4 prefix "FINAL_REJECT: "
	0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

I'm guessing the method that libvirtd uses to watch when firewalld
reloads the firewall, so that libvirt can add its own rules, is not
always effective.
#942368#10
Date:
2021-05-24 21:11:50 UTC
From:
To:
Greeting to you once again



I am writing for the second time as I did not receive any reply from you to
my previous message.



Kindly reply so we can discuss the subject as soon as possible.



Sincerely,



Andy Landman