On Sun, Nov 17, 2019 at 10:14 AM Ed Greshko <ed.greshko@xxxxxxxxxxx> wrote:
> On 11/17/19 5:07 PM, Tom H wrote:
>> On Sun, Nov 17, 2019 at 1:49 AM Ed Greshko <ed.greshko@xxxxxxxxxxx> wrote:
>>>
>>> I put the interface virbr0 in the FW zone libvirt.
>>
>> Wow. Weird that virbr0 is firewalled, but good to know. Thanks.
>
> Yep, and as my other post states I think it always was there. If
> one reads the description in
> /usr/lib/firewalld/zones/libvirt.xml they'd see.
>
> <description>
> The default policy of "ACCEPT" allows all packets to/from
> interfaces in the zone to be forwarded, while the (*low priority*)
> reject rule blocks any traffic destined for the host, except those
> services explicitly listed (that list can be modified as required
> by the local admin). This zone is intended to be used only by
> libvirt virtual networks - libvirt will add the bridge devices for
> all new virtual networks to this zone by default.
> </description>
Thanks. I assume that you didn't just add virbr0 to the libvirt zone,
but that you also added the three nfs-related services to this zone.
Comment from the libvirt source
/* if firewalld is active, try to set the "libvirt" zone. This is
* desirable (for consistency) if firewalld is using the iptables
* backend, but is necessary (for basic network connectivity) if
* firewalld is using the nftables backend
*/
So it's an nftables requirement.
_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
